Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-runtime-dbg-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-runtime-dbg-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK SDK_VERSION and .NET Runtime RUNTIME_VERSION.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:25: dotnet8-runtime, Alpaquita:stream: dotnet8-runtime

Affected: Bitnami: dotnet

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Affected: NuGet: System.Security.Cryptography.Xml

## Executive Summary:

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/392

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** 7.5 CVSS: 3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-835 CWE-400 CWE-20: Loop with Unreachable Exit Condition ('Infinite Loop') Uncontrolled Resource Consumption Improper Input Validation

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

### <a name=".NET 10"></a>.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >=10.0.0, <=10.0.5 | 10.0.6

### <a name=".NET 9"></a>.NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System…

CVE-2026-0390 | UEFI Secure Boot Security Feature Bypass Vulnerability CVE-2026-20806 | Windows COM Server Information Disclosure Vulnerability CVE-2026-20928 | Windows Recovery Environment Security Feature Bypass Vulnerability CVE-2026-20930 | Windows Management Services Elevation of Privilege Vulnerability CVE-2026-23666 | .NET Framework Denial of Service Vulnerability CVE-2026-23670 | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability CVE-2026-25250 | MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix CVE-2026-26151 | Remote Desktop Spoofing Vulnerability CVE-2026-26152 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability CVE-2026-26153 | Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability CVE-2026-26155 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability CVE-2026-26156 | Windows Hyper-V Remote Code Execution Vulnerability CVE-2026-26159 | Remote Desktop Licensing Service Elevation of Privilege Vulnerability CVE-2026-26160 | Remote Desktop Licensing Service Elevation of Privilege Vulnerability CVE-2026-26161 | Windows Sensor Data Service Elevation of Privilege Vulnerability CVE-2026-26162 | Windows OLE Elevation of Privilege Vulnerability CVE-2026-26163 | Windows Kernel Elevation of Privilege Vulnerability CVE-2026-26167 | Windows Push Notifications Elevation of Privilege Vulnerability CVE-2026-26168 | Windows Ancillary Function Driver for WinSo…

dotnet: .NET: Security Bypass and Denial of Service Vulnerability dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw dotnet: .NET: Denial of Service via stack overflow dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

dotnet: .NET: Security Bypass and Denial of Service Vulnerability dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw dotnet: .NET: Denial of Service via stack overflow dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft .NET Framework, Microsoft .NET, Microsoft PowerShell und Microsoft Visual Studio Code ausnutzen, um vertrauliche Informationen offenzulegen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen oder Sicherheitsmaßnahmen zu umgehen, was möglicherweise die Ausführung von beliebigem Code ermöglicht.