CVE-2026-58280

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-58280) has been identified in .NET's Signed XML implementation, System.Security.Cryptography.Xml, which allows an unauthenticated attacker to crash an application that verifies or decrypts attacker-supplied XML by sending a deeply nested document.

Per CWE-674: Uncontrolled Recursion, the weakness is a product that does not properly control the amount of recursion that takes place, consuming excessive resources such as allocated memory or the program stack.

This issue affects .NET 6, including NES for .NET releases through 6.0.46. System.Security.Cryptography.Xml ships in-box in the ASP.NET Core and Windows Desktop shared frameworks, so every ASP.NET Core, WPF, and Windows Forms application carries it without a package reference, and it is also published as a standalone NuGet package. Applications are exposed when they verify, canonicalize, or decrypt untrusted XML through SignedXml or EncryptedXml, as SAML, WS-Federation, and WS-Trust token handling does. Microsoft's advisory names System.Security.Cryptography.Xml and System.Private.Xml and lists the .NET runtime packs for 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.AspNetCore.App and Microsoft.WindowsDesktop.App (in-box copies of System.Security.Cryptography.Xml); System.Security.Cryptography.Xml (standalone NuGet package); Microsoft.NETCore.App (System.Private.Xml, which carries part of Microsoft's fix)
• Affected versions:
  
  • Microsoft.NETCore.App, Microsoft.AspNetCore.App, Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.46
  • System.Security.Cryptography.Xml >= 6.0.0 <= 6.0.2.2
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows); System.Security.Cryptography.Xml on NuGet
• Fixed in: NES for .NET 6.0.47 (System.Security.Cryptography.Xml 6.0.2.3)

Vulnerability Info

This High-severity vulnerability is found in the System.Security.Cryptography.Xml library as shipped for .NET 6. SignedXml and EncryptedXml load and re-parse documents, including fragments produced by decryption, during signature verification and decryption. None of these parses limited how deeply elements could nest, so a sufficiently deep document exhausted the thread's stack. A stack overflow cannot be caught in .NET, so the whole process terminates rather than a single request failing.

NES for .NET 6.0.47 reads every document these APIs load or re-parse through a depth-limited reader, with a default limit of 64 levels set by the AppContext setting System.Security.Cryptography.Xml.CryptoXmlMaxInputDocumentDepth. DTD processing is also now off by default on these paths, and entity references in decrypted fragments are rejected. Applications that genuinely need DTDs can turn processing back on with System.Security.Cryptography.Xml.CryptoXmlAllowDtdProcessing. The release also carries the System.Private.Xml part of Microsoft's change in Microsoft.NETCore.App: XmlTextReader no longer reprocesses every attribute each time it reloads its buffer.

CVE-2026-58280, CVE-2026-69651, CVE-2026-96958, CVE-2026-96959 and CVE-2026-96960 were reported separately and are addressed together by the same Signed XML hardening in NES for .NET 6.0.47, matching Microsoft's fix.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET 8.0.32 or later
  • .NET 9.0.21 or later
  • .NET 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later. Applications with an explicit System.Security.Cryptography.Xml package reference should also move it to 6.0.2.3 from the NES feed, because NuGet otherwise keeps resolving Microsoft's unpatched 6.0.2.

Credits

Leandro Batista, as credited in Microsoft's advisory.