Key points
- The flaw stems from inefficient algorithmic complexity in System.Security.Cryptography.Xml.
- It affects .NET 8, 9, 10, and 11 runtimes across Windows, Linux, and macOS.
- Microsoft has released patched versions for all affected runtime branches.
An unauthenticated attacker can disrupt network services running vulnerable .NET versions. This remote denial of service capability arises from how the runtime processes specific XML inputs. Microsoft identifies the issue as high severity. The vulnerability allows service interruption without requiring prior access or user interaction.
In plain English
The .NET framework handles XML data using components within System.Security.Cryptography.Xml. Certain processing tasks lacked sufficient limits on computational effort. An attacker can craft inputs that force the system to expend excessive resources. This leads to service unavailability for legitimate users. The core problem is an inefficient algorithmic complexity.
The background
Microsoft confirms the vulnerability impacts multiple runtime versions. Affected releases include .NET 8 through 9.0.20, 10 through 10.0.12, and preview builds of 11. The issue spans all supported architectures for Windows, Linux, and macOS. The vendor rates the severity as high.
What changes now
Microsoft provides patched versions for each affected branch. .NET 8 users should update to 8.0.32. .NET 9 requires version 9.0.21. .NET 10 needs 10.0.13. .NET 11 preview users must move to 11.0.0-rc.2. These updates introduce input-depth and operation-count limits.
The attacker's path
Teams usually monitor for resource exhaustion patterns indicative of algorithmic complexity attacks. Check whether applications accept untrusted XML from network sources. Verify that parsing libraries enforce strict depth and entity limits. Ensure that default configurations prohibit dangerous features like DTD processing. Review logs for abnormal CPU or memory spikes during XML handling phases.
What to do and how to stay safe: Microsoft
- Identify all managed services running .NET versions prior to the patched releases.
- Apply the vendor-provided updates to move to the secure version ranges listed.
- Monitor server resource usage for unusual spikes that may indicate exploitation attempts.
- Review application configurations to ensure XML processing limits are enforced.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-69651?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable.
What is the CVSS score for this vulnerability?
The Common Vulnerability Scoring System version 3.1 score is 7.5, rated as high severity.
Does this vulnerability allow code execution?
No, the advisory states it allows an unauthorized attacker to deny service over a network.
