Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, `EnvelopedCms.Decode` can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/454 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.9 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptogr
- Products
- System.Security.Cryptography.Pkcs
- Affected versions
- 10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 8.0.0, 8.0.1, 9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
- Fixed versions
- 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21
- CVEs
- CVE-2026-70162
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 08:26 UTC · Revision 1
Source evidence
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
core-osv · Original sourcePublished 13 Oct 2026, 20:07 UTC
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, `EnvelopedCms.Decode` can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/454 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.9 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptogr
osv:GHSA-2fmv-rv2c-59x7
System.Security.Cryptography.Pkcs
Fixed versions: 10.0.13
System.Security.Cryptography.Pkcs
Fixed versions: 11.0.0-rc.2
System.Security.Cryptography.Pkcs
Fixed versions: 8.0.2
System.Security.Cryptography.Pkcs
Fixed versions: 9.0.21
Complete source record
{
"id": "a0c386726ee5acd345e376fa528d448310b6926dd1974c0f78d46bf03c634007",
"url": "https://osv.dev/vulnerability/GHSA-2fmv-rv2c-59x7",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability",
"summary": "## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, `EnvelopedCms.Decode` can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/454 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.9 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification)) ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptogr",
"evidence": "osv:GHSA-2fmv-rv2c-59x7",
"products": [
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.0.13",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "10.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.10",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.11",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.12",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.2",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.3",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.4",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.5",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.6",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.7",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.8",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-rc.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.0.2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.0.0",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "System.Security.Cryptography.Pkcs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.21",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "9.0.0",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.1",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.10",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.11",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.12",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.13",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.14",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.15",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.16",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.17",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.18",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.19",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.2",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.20",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.3",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.4",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.5",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.6",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.7",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.8",
"evidence": "/affected/3/versions"
},
{
"value": "9.0.9",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "GHSA-2fmv-rv2c-59x7",
"aliases": [
"CVE-2026-70162",
"GHSA-2fmv-rv2c-59x7"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.13"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2fmv-rv2c-59x7/GHSA-2fmv-rv2c-59x7.json",
"last_known_affected_version_range": "<= 10.0.12"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-preview.1"
},
{
"fixed": "11.0.0-rc.2"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2fmv-rv2c-59x7/GHSA-2fmv-rv2c-59x7.json",
"last_known_affected_version_range": "<= 11.0.0-rc.1"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.2"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"8.0.0",
"8.0.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2fmv-rv2c-59x7/GHSA-2fmv-rv2c-59x7.json",
"last_known_affected_version_range": "<= 8.0.1"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.21"
}
]
}
],
"package": {
"name": "System.Security.Cryptography.Pkcs",
"purl": "pkg:nuget/System.Security.Cryptography.Pkcs",
"ecosystem": "NuGet"
},
"versions": [
"9.0.0",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.15",
"9.0.16",
"9.0.17",
"9.0.18",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.3",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2fmv-rv2c-59x7/GHSA-2fmv-rv2c-59x7.json",
"last_known_affected_version_range": "<= 9.0.20"
}
}
],
"modified": "2026-10-19T19:30:12.570785617Z",
"provider": "osv",
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7",
"https://nvd.nist.gov/vuln/detail/CVE-2026-70162",
"https://github.com/dotnet/announcements/issues/454",
"https://github.com/dotnet/runtime/issues/135699",
"https://github.com/dotnet/runtime",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"
],
"provider_metadata": {
"cwe_ids": [
"CWE-405"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-10-13T19:19:29Z",
"github_reviewed_at": "2026-10-13T20:07:20Z"
}
},
"related_cves": [
{
"value": "CVE-2026-70162",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 375757,
"published_at": "2026-10-13T20:07:20+00:00"
}