GHSA-cvvh-rhrc-wg4q

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410

CVSS Details

• Version: 3.1
• Severity: High
• Score: 7.5
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling)

Affected Platforms

• Platforms: All
• Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10.0"></a>.NET 10.0

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- System.Security.Cryptography.Xml | >= 10.0.0, <= 10.0.9 | 10.0.10 Microsoft.NetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.9 | 10.0.10 Microsoft.NetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.9 | 10.0.10...