Microsoft fixes XML algorithmic complexity flaw CVE-2026-69651 in .NET 8-11 runtimes to block remote DoS attacks

Microsoft has released security updates for .NET runtimes to address a high-severity denial of service vulnerability identified as CVE-2026-69651. The flaw affects multiple major versions of the framework across Windows, Linux, and macOS platforms.

What happened

Microsoft disclosed that inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. According to the Microsoft Security Update Guide, the issue stems from how the framework processes certain inputs. The GitHub advisory GHSA-3rxq-g8rj-r2cf rates the severity as high with a CVSS score of 7.5. The vulnerability is classified under CWE-407.

The flaw impacts System.Security.Cryptography.Xml and System.Private.Xml components. Microsoft states that fixes add input-depth and operation-count limits to signed XML processing. The updates also prohibit DTD processing by default and validate entity references. Additionally, the patches bound encrypted-data candidate processing and cap attributes used by C14N transforms.

Why it matters

The vulnerability affects .NET 8, 9, 10, and 11 runtimes across all architectures for Windows, Linux, and macOS. For .NET 8, versions 8.0.0 through 8.0.31 are vulnerable, with 8.0.32 providing the fix. In .NET 9, versions 9.0.0 through 9.0.20 are affected, patched by 9.0.21. .NET 10 versions 10.0.0 through 10.0.12 require an update to 10.0.13.

Preview and release candidate versions of .NET 11 are also impacted. Versions 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable, while 11.0.0-rc.2 contains the remediation. The affected packages include runtime libraries for linux-arm, linux-arm64, linux-musl-arm, linux-musl-arm64, linux-musl-x64, linux-x64, osx-arm64, osx-x64, win-arm64, win-x64, and win-x86.

What to watch

• Verify installed .NET runtime versions against the patched lists provided by Microsoft.
• Monitor internal logs for signs of service degradation or abnormal resource consumption.
• Check deployment pipelines to ensure builds pull the latest patched NuGet packages.
• Review XML processing configurations for any custom overrides that might bypass defaults.

Who needs to act first

Teams should prioritize updating systems exposed to untrusted network input, as these face the highest risk of remote denial of service. Begin by identifying public-facing applications and APIs that process XML data. Roll out updates in staging environments first to validate compatibility with existing workloads. Ensure backup procedures are current before applying changes to production infrastructure. Coordinate with development teams to verify that application dependencies resolve to the patched runtime versions.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Audit inventory for all servers and containers running vulnerable .NET runtime versions.
• Update NuGet package references to the patched versions specified in the advisory.
• Restrict network access to services that cannot be immediately patched.
• Validate that XML processing components enforce the new input-depth limits.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-69651?

Versions 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, and 11.0.0-preview.1-11.0.0-rc.1 are vulnerable.

Is there a patch available for this vulnerability?

Yes, patches are available in .NET 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.

What is the CVSS score for this issue?

The CVSS 3.1 score is 7.5, rated as high severity.