System.Security.Cryptography.Xml Algorithmic Complexity Flaw CVE-2026-96958 Hits .NET 8-11
Microsoft addresses a high-severity algorithmic complexity flaw in System.Security.Cryptography.Xml that allows remote denial of service attacks.
Key points
- Vulnerability CVE-2026-96958 affects .NET versions 8 through 11.
- The flaw enables unauthorized network-based denial of service.
- Patches are available for all affected package ranges.
Microsoft released security updates to address a high-severity denial of service vulnerability in the .NET framework. The flaw, tracked as CVE-2026-96958, exists in the System.Security.Cryptography.Xml package and impacts applications running on Windows, Linux, and macOS. An unauthorized attacker can exploit inefficient algorithmic complexity to deny service over a network, according to the Microsoft Security Update Guide.
Root cause
The underlying issue is inefficient algorithmic complexity within the XML processing libraries. Microsoft's advisory notes that fixes include adding input-depth and operation-count limits. The updates also prohibit Document Type Definition processing by default and validate entity references. Additionally, the patches bound encrypted-data candidate processing and cap attributes used by C14N transforms to prevent resource exhaustion.
Attack path
An attacker does not need authentication to exploit this flaw. The CVSS vector indicates network access with low complexity is required. Because the vulnerability allows denial of service, successful exploitation results in high impact on availability. The attack can be launched remotely without user interaction, making exposed services vulnerable to unauthenticated disruption.
Affected versions
- System.Security.Cryptography.Xml 8.0.0 through 8.0.4; patched in 8.0.5
- System.Security.Cryptography.Xml 9.0.0 through 9.0.20; patched in 9.0.21
- System.Security.Cryptography.Xml 10.0.0 through 10.0.12; patched in 10.0.13
- System.Security.Cryptography.Xml 11.0.0-preview.1 through 11.0.0-rc.1; patched in 11.0.0-rc.2
Mitigation
- Update System.Security.Cryptography.Xml to the patched versions listed above.
- Review application dependencies to ensure no vulnerable transitive packages remain.
- Restrict network access to XML processing endpoints where possible.
- Monitor for unusual CPU or memory spikes indicative of algorithmic attacks.
Detection notes
Teams usually observe sudden spikes in CPU usage or memory consumption on services processing XML input. Check whether application logs show unusually long processing times for small requests. Look for repeated connection drops or timeouts from specific source IPs. First containment moves involve rate-limiting incoming XML requests and isolating affected service instances. Verify that monitoring alerts trigger on resource exhaustion patterns rather than just error codes. Review firewall logs for bursts of traffic targeting XML endpoints.
What to do and how to stay safe: Microsoft
- Audit your NuGet package dependencies for System.Security.Cryptography.Xml versions prior to the patched releases.
- Apply the latest updates to your .NET runtime and libraries once the vendor provides an update.
- Monitor server resource metrics for anomalies that suggest algorithmic complexity exploitation.
- Test XML parsing endpoints with large or complex payloads to verify resilience.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96958?
The CVSS 3.1 score is 7.5, which is rated as high severity.
Which operating systems are affected by this vulnerability?
The vulnerability affects Windows, Linux, and macOS platforms across all architectures.
Is there a patch available for .NET 10?
Yes, version 10.0.13 of System.Security.Cryptography.Xml contains the fix.
