.NET XML Library Patch Available for High-Severity Denial of Service Flaw

Microsoft has released security updates for the .NET framework to address a high-severity denial of service vulnerability in its cryptographic XML library. The flaw, identified as CVE-2026-96959, allows unauthorized network attackers to consume excessive system resources, potentially rendering services unavailable.

What happened

The vulnerability stems from a failure to enforce limits on resource allocation within the `System.Security.Cryptography.Xml` package. According to the Microsoft Security Update Guide, this lack of throttling enables an unauthorized attacker to deny service over a network. The issue is classified under CWE-770, which covers allocation of resources without limits or throttling.

The flaw affects multiple versions of the library across different .NET releases. Specifically, versions 8.0.0 through 8.0.4, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are vulnerable. Additionally, preview and release candidate versions of .NET 11, from 11.0.0-preview.1 up to 11.0.0-rc.1, are also affected.

Microsoft has patched these issues in specific subsequent versions. Users should upgrade to 8.0.5, 9.0.21, 10.0.13, or 11.0.0-rc.2, depending on their current runtime. The fixes introduce input-depth and operation-count limits, prohibit DTD processing by default, and validate entity references to bound encrypted-data candidate processing.

Why it matters

The Common Vulnerability Scoring System rate this flaw as high severity with a score of 7.5. The CVSS vector indicates that the attack can be launched remotely over a network with low complexity and no required privileges. This means any service exposing XML parsing capabilities from this library to external inputs is at risk.

The vulnerability spans Windows, Linux, and macOS platforms and affects all architectures. According to the GitHub advisory, the fix also caps the number of attributes and namespaces used by C14N transforms. This broad platform support means .NET applications deployed in mixed environments must be checked and updated to prevent potential service disruption.

What to watch

• Verify if your applications reference `System.Security.Cryptography.Xml` in their dependency trees.
• Check the specific version numbers against the affected ranges listed in the advisory.
• Monitor application logs for signs of resource exhaustion or slow response times from XML processing.
• Ensure automated build pipelines pull the latest patched NuGet packages during deployments.

Who needs to act first

Teams should prioritize updating systems that expose XML parsing endpoints to untrusted users. Begin by identifying which applications use the vulnerable library versions in production environments. Test the patched versions in staging to ensure compatibility with existing workflows before rolling out updates. Back up application configurations and data prior to making changes. If immediate patching is not possible, consider implementing network-level restrictions to limit access to endpoints that process external XML inputs.

What to do and how to stay safe: Microsoft

• Inventory all .NET applications to determine which ones depend on the `System.Security.Cryptography.Xml` package.
• Compare current package versions against the affected ranges: 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1.
• Update vulnerable packages to the patched versions: 8.0.5, 9.0.21, 10.0.13, or 11.0.0-rc.2 respectively.
• Validate that the updated applications function correctly and that the new security limits do not break legitimate XML processing workflows.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a fix available for this vulnerability?

Yes, Microsoft has released patched versions of the `System.Security.Cryptography.Xml` package for affected .NET versions 8, 9, 10, and 11.

Which platforms are affected by CVE-2026-96959?

The vulnerability affects .NET applications running on Windows, Linux, and macOS across all supported architectures.

What is the severity rating for this flaw?

The vulnerability is rated as high severity with a CVSS score of 7.5, allowing remote denial of service attacks without authentication.