EOL Fix Available | CVE-2026-47304

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A signature-forgery vulnerability (CVE-2026-47304) has been identified in the XML Signature verification of the System.Security.Cryptography.Xml component, which allows attackers to have a forged or truncated HMAC signature accepted as valid. When a signature is verified with a keyed hash algorithm, the library compares only as many bytes as the attacker-supplied signature contains, so a zero-length or partial signature can match a prefix of the real HMAC and pass verification.

Per CWE-347: Improper Verification of Cryptographic Signature, the product does not verify, or incorrectly verifies, the cryptographic signature for data.

This issue affects .NET 6 On .NET 6, System.Security.Cryptography.Xml is not part of the shared framework; it ships as an opt-in NuGet package (https://www.nuget.org/packages/System.Security.Cryptography.Xml), so only applications that add an explicit package reference to it are exposed.

‍

Details

Module Info

Product: .NET
Affected packages: System.Security.Cryptography.Xml
Affected versions: System.Security.Cryptography.Xml >= 6.0.0 < 6.0.2
GitHub repository: https://github.com/dotnet/runtime
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the System.Security.Cryptography.Xml package as shipped for .NET 6.0. When a document is verified with an HMAC key through SignedXml.CheckSignature(KeyedHashAlgorithm), verification ends in CheckSignedInfo, which compares the provided SignatureValue against the computed HMAC one byte at a time, looping only over the length of the supplied signature:

for (int i = 0; i < m_signature.SignatureValue.Length; i++)
{
    if (m_signature.SignatureValue[i] != hashValue[i]) return false;
}
return true;

A caller that controls the signed document can set SignedInfo.SignatureLength to zero (or a small value), which produces a SignatureValue of that many bytes. The loop then compares only those bytes against the true HMAC and returns true, so the signature is accepted without ever matching the full HMAC. The library's default format validator rejects truncated HMACs, but the bypass is reachable whenever an application replaces SignatureFormatValidator with null or a permissive validator, a documented and supported configuration. An attacker who can supply an XML-DSig document, SOAP message, or signed configuration to such an application can forge a signature that verifies against a key they do not possess, defeating the integrity and authenticity the signature is meant to guarantee.

The fixed releases compare the full computed HMAC against the supplied signature and reject any length mismatch. The previous, insecure comparison is available only by explicitly enabling the AppContext switch Switch.System.Security.Cryptography.Xml.SignedXml.AllowUnsafeTruncatedHmacSignatureVerification (default off), which exists as a compatibility escape hatch for consumers that legitimately relied on the old behavior.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- System.Security.Cryptography.Xml >= 8.0.4
- System.Security.Cryptography.Xml >= 9.0.18
- System.Security.Cryptography.Xml >= 10.0.10
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍