Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/490 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/Sys
- Products
- System.Security.Cryptography.Xml
- Affected versions
- 10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
- Fixed versions
- 10.0.13, 11.0.0-rc.2, 8.0.5, 9.0.21
- CVEs
- CVE-2026-96960
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 08:18 UTC · Revision 1
Source evidence
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
core-osv · Original sourcePublished 13 Oct 2026, 20:26 UTC
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/490 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/Sys
osv:GHSA-7hqp-7c5m-4vq6
System.Security.Cryptography.Xml
Fixed versions: 10.0.13
System.Security.Cryptography.Xml
Fixed versions: 11.0.0-rc.2
System.Security.Cryptography.Xml
Fixed versions: 8.0.5
System.Security.Cryptography.Xml
Fixed versions: 9.0.21
Complete source record
{
"id": "f75424cfd2ca63b787a8406659f3bc6f012e8bddcf6207fafae873417531ebb8",
"url": "https://osv.dev/vulnerability/GHSA-7hqp-7c5m-4vq6",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability",
"summary": "## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/490 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Xml](https://www.nuget.org/packages/Sys",
"evidence": "osv:GHSA-7hqp-7c5m-4vq6",
"products": [
{
"name": {
"value": "System.Security.Cryptography.Xml",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.0.13",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "10.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.10",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.11",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.12",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.2",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.3",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.4",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.5",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.6",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.7",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.8",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Xml",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-rc.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "System.Security.Cryptography.Xml",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.0.5",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.0.0",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.1",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.2",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.3",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Xml",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.21",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "9.0.0",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.1",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.10",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.11",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.12",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.13",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.14",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.15",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.16",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.17",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.18",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.19",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.2",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.20",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.3",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.4",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.5",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.6",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.7",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.8",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.9",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "GHSA-7hqp-7c5m-4vq6",
"aliases": [
"BIT-dotnet-2026-96960",
"BIT-dotnet-sdk-2026-96960",
"CVE-2026-96960",
"GHSA-7hqp-7c5m-4vq6"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.13"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Xml",
"purl": "pkg:nuget/System.Security.Cryptography.Xml",
"ecosystem": "NuGet"
},
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hqp-7c5m-4vq6/GHSA-7hqp-7c5m-4vq6.json",
"last_known_affected_version_range": "<= 10.0.12"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-preview.1"
},
{
"fixed": "11.0.0-rc.2"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Xml",
"purl": "pkg:nuget/System.Security.Cryptography.Xml",
"ecosystem": "NuGet"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hqp-7c5m-4vq6/GHSA-7hqp-7c5m-4vq6.json",
"last_known_affected_version_range": "<= 11.0.0-rc.1"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.5"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Xml",
"purl": "pkg:nuget/System.Security.Cryptography.Xml",
"ecosystem": "NuGet"
},
"versions": [
"8.0.0",
"8.0.1",
"8.0.2",
"8.0.3",
"8.0.4"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hqp-7c5m-4vq6/GHSA-7hqp-7c5m-4vq6.json",
"last_known_affected_version_range": "<= 8.0.4"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.21"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Xml",
"purl": "pkg:nuget/System.Security.Cryptography.Xml",
"ecosystem": "NuGet"
},
"versions": [
"9.0.0",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.15",
"9.0.16",
"9.0.17",
"9.0.18",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.3",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hqp-7c5m-4vq6/GHSA-7hqp-7c5m-4vq6.json",
"last_known_affected_version_range": "<= 9.0.20"
}
}
],
"modified": "2026-10-19T16:30:05.097405610Z",
"provider": "osv",
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-7hqp-7c5m-4vq6",
"https://nvd.nist.gov/vuln/detail/CVE-2026-96960",
"https://github.com/dotnet/announcements/issues/490",
"https://github.com/dotnet/runtime",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960"
],
"provider_metadata": {
"cwe_ids": [
"CWE-405"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2026-10-13T19:22:08Z",
"github_reviewed_at": "2026-10-13T20:26:27Z"
}
},
"related_cves": [
{
"value": "CVE-2026-96960",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 375338,
"published_at": "2026-10-13T20:26:27+00:00"
}