CVE-2026-96959

Name of the Vulnerable Software and Affected Versions System.Security.Cryptography.Xml versions 10.0.0 through 10.0.12 System.Security.Cryptography.Xml versions 11.0.0-preview.1 through 11.0.0-rc.1 System.Security.Cryptography.Xml versions 8.0.0 through 8.0.4 System.Security.Cryptography.Xml versions 9.0.0 through 9.0.20

Description Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to cause a denial of service over a network. The issue exists within System.Security.Cryptography.Xml and System.Private.Xml. The fix involves implementing input-depth and operation-count limits, prohibiting DTD processing by default, validating entity references, bounding encrypted-data candidate processing, and capping attributes and namespaces used by C14N transforms.

Recommendations Update System.Security.Cryptography.Xml version 10.0.0 through 10.0.12 to version 10.0.13. Update System.Security.Cryptography.Xml version 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update System.Security.Cryptography.Xml version 8.0.0 through 8.0.4 to version 8.0.5. Update System.Security.Cryptography.Xml version 9.0.0 through 9.0.20 to version 9.0.21. Recompile and redeploy any self-contained applications targeting the affected versions.