Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. `SignedCms.CheckSignature` can repeatedly reparse attacker-controlled X.509 data, causing unauthenticated quadratic CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/468 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-407 (Inefficient Algorithmic Complexity) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/pac
- Products
- System.Security.Cryptography.Pkcs
- Affected versions
- 10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 8.0.0, 8.0.1, 9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
- Fixed versions
- 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21
- CVEs
- CVE-2026-84008
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 08:26 UTC · Revision 1
Source evidence
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
core-osv · Original sourcePublished 13 Oct 2026, 20:03 UTC
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. `SignedCms.CheckSignature` can repeatedly reparse attacker-controlled X.509 data, causing unauthenticated quadratic CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/468 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-407 (Inefficient Algorithmic Complexity) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/pac
osv:GHSA-846f-f764-76mx
System.Security.Cryptography.Pkcs
Fixed versions: 10.0.13
System.Security.Cryptography.Pkcs
Fixed versions: 11.0.0-rc.2
System.Security.Cryptography.Pkcs
Fixed versions: 8.0.2
System.Security.Cryptography.Pkcs
Fixed versions: 9.0.21
Complete source record
{
"id": "fe3a468949380bef1830ef17176159f838ceadca77b10d5a1592a6b4ebc33c5a",
"url": "https://osv.dev/vulnerability/GHSA-846f-f764-76mx",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability",
"summary": "## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. `SignedCms.CheckSignature` can repeatedly reparse attacker-controlled X.509 data, causing unauthenticated quadratic CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/468 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-407 (Inefficient Algorithmic Complexity) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/pac",
"evidence": "osv:GHSA-846f-f764-76mx",
"products": [
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.0.13",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "10.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.10",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.11",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.12",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.2",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.3",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.4",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.5",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.6",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.7",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.8",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-rc.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.0.2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.0.0",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.21",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "9.0.0",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.1",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.10",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.11",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.12",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.13",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.14",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.15",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.16",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.17",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.18",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.19",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.2",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.20",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.3",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.4",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.5",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.6",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.7",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.8",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.9",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "GHSA-846f-f764-76mx",
"aliases": [
"CVE-2026-84008",
"GHSA-846f-f764-76mx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.13"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-846f-f764-76mx/GHSA-846f-f764-76mx.json",
"last_known_affected_version_range": "<= 10.0.12"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-preview.1"
},
{
"fixed": "11.0.0-rc.2"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-846f-f764-76mx/GHSA-846f-f764-76mx.json",
"last_known_affected_version_range": "<= 11.0.0-rc.1"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.2"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"8.0.0",
"8.0.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-846f-f764-76mx/GHSA-846f-f764-76mx.json",
"last_known_affected_version_range": "<= 8.0.1"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.21"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"9.0.0",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.15",
"9.0.16",
"9.0.17",
"9.0.18",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.3",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-846f-f764-76mx/GHSA-846f-f764-76mx.json",
"last_known_affected_version_range": "<= 9.0.20"
}
}
],
"modified": "2026-10-19T19:30:13.209388554Z",
"provider": "osv",
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx",
"https://nvd.nist.gov/vuln/detail/CVE-2026-84008",
"https://github.com/dotnet/announcements/issues/468",
"https://github.com/dotnet/runtime/issues/135703",
"https://github.com/dotnet/runtime",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"
],
"provider_metadata": {
"cwe_ids": [
"CWE-407"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2026-10-13T19:20:50Z",
"github_reviewed_at": "2026-10-13T20:03:30Z"
}
},
"related_cves": [
{
"value": "CVE-2026-84008",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 375759,
"published_at": "2026-10-13T20:03:30+00:00"
}