CVE-2026-69651

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-69651) has been identified in .NET's XML Encryption implementation, EncryptedXml in System.Security.Cryptography.Xml, which allows an unauthenticated attacker to exhaust CPU on an application that decrypts attacker-supplied XML by sending a document whose key information is very wide.

Per CWE-407: Inefficient Algorithmic Complexity, an algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker.

This issue affects .NET 6, including NES for .NET releases through 6.0.46. System.Security.Cryptography.Xml ships in-box in the ASP.NET Core and Windows Desktop shared frameworks, so every ASP.NET Core, WPF, and Windows Forms application carries it without a package reference, and it is also published as a standalone NuGet package. Applications are exposed when they decrypt untrusted XML through EncryptedXml, or verify signatures that use the XML decryption transform. Microsoft's advisory names System.Security.Cryptography.Xml and System.Private.Xml and lists the .NET runtime packs for 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.AspNetCore.App and Microsoft.WindowsDesktop.App (in-box copies of System.Security.Cryptography.Xml); System.Security.Cryptography.Xml (standalone NuGet package); Microsoft.NETCore.App (System.Private.Xml, which carries part of Microsoft's fix)
• Affected versions:
  
  • Microsoft.NETCore.App, Microsoft.AspNetCore.App, Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.46
  • System.Security.Cryptography.Xml >= 6.0.0 <= 6.0.2.2
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows); System.Security.Cryptography.Xml on NuGet
• Fixed in: NES for .NET 6.0.47 (System.Security.Cryptography.Xml 6.0.2.3)

Vulnerability Info

This High-severity vulnerability is found in the EncryptedXml class of System.Security.Cryptography.Xml as shipped for .NET 6. To decrypt an EncryptedData element, EncryptedXml resolves its key by walking the element's KeyInfo, which can name further keys and EncryptedKey elements that must themselves be looked up and decrypted. Nothing limited how many key lookups and EncryptedKey decryptions a single operation could perform, so a document with a very broad KeyInfo made the work grow quadratically with the document's size.

NES for .NET 6.0.47 caps key lookups and EncryptedKey decryptions per top-level operation at 256 by default, through the AppContext setting System.Security.Cryptography.Xml.DangerousMaxDecryptionCount. Exceeding the cap throws a CryptographicException. The release also carries the System.Private.Xml part of Microsoft's change in Microsoft.NETCore.App: XmlTextReader no longer reprocesses every attribute each time it reloads its buffer.

CVE-2026-58280, CVE-2026-69651, CVE-2026-96958, CVE-2026-96959 and CVE-2026-96960 were reported separately and are addressed together by the same Signed XML hardening in NES for .NET 6.0.47, matching Microsoft's fix.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET 8.0.32 or later
  • .NET 9.0.21 or later
  • .NET 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later. Applications with an explicit System.Security.Cryptography.Xml package reference should also move it to 6.0.2.3 from the NES feed, because NuGet otherwise keeps resolving Microsoft's unpatched 6.0.2.

Credits

l8BL with ENKI WhiteHat (https://enki.co.kr/), Leandro Batista, Kevin Schmidt, and Dr.-Ing Ashar Javed (@soaj1664ashar), as credited in Microsoft's advisory.