CVE-2026-96958
Fixed in a distro release EPSS 1%CVSS 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Products: Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.8.1, Microsoft System.Security.Cryptography.Xml
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | System.Security.Cryptography.Xml | 10.0.13 |
| NuGet | System.Security.Cryptography.Xml | 11.0.0-rc.2 |
| NuGet | System.Security.Cryptography.Xml | 8.0.5 |
| NuGet | System.Security.Cryptography.Xml | 9.0.21 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | aspnet-9-targeting-pack | 9.0.122-r0 |
| Chainguard | dotnet-10-sdk | 10.0.113-r1 |
| Chainguard | dotnet-8-sdk | 8.0.132-r0 |
| Chainguard | dotnet-9-sdk | 9.0.122-r0 |
| Chainguard | dotnet-bootstrap-8 | no fix |
| Chainguard | dotnet-bootstrap-9 | no fix |
| Chainguard | dotnet-sdk-10.0.2 | 10.0.204-r9 |
| Chainguard | dotnet-sdk-10.0.3 | 10.0.303-r7 |
| Chainguard | dotnet-sdk-10.0.4 | 10.0.402-r0 |
| Chainguard | dotnet-sdk-stage0-10 | 10.0.113-r0 |
| Chainguard | promitor | 2.16.1-r1 |
| Ubuntu 22.04 LTS | dotnet6 | no fix |
| Ubuntu 22.04 LTS | dotnet7 | no fix |
| Ubuntu 22.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~22.04.1 |
| Ubuntu 24.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~24.04.1 |
| Ubuntu 24.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~24.04.1 |
| Ubuntu 26.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.04.1 |
| Ubuntu 26.10 | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.10.1 |
| Ubuntu 26.10 | dotnet11 | 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1 |
| Wolfi | aspnet-9-targeting-pack | 9.0.122-r0 |
| Wolfi | dotnet-10-sdk | 10.0.113-r1 |
| Wolfi | dotnet-8-sdk | 8.0.132-r0 |
| Wolfi | dotnet-9-sdk | 9.0.122-r0 |
| Wolfi | dotnet-bootstrap-8 | no fix |
| Wolfi | dotnet-bootstrap-9 | no fix |
| Wolfi | dotnet-sdk-10.0.2 | 10.0.204-r9 |
| Wolfi | dotnet-sdk-10.0.3 | 10.0.303-r7 |
| Wolfi | dotnet-sdk-10.0.4 | 10.0.402-r0 |
| Wolfi | dotnet-sdk-stage0-10 | 10.0.113-r0 |
| Wolfi | promitor | 2.16.1-r1 |