Known vulnerabilities and malicious package reports for System.Security.Cryptography.Xml on NuGet, live from OSV, with CISA KEV exploitation status and EPSS scores.
0 malicious package reports and 15 vulnerabilities returned by OSV. Check a specific version to see which reports apply.
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Published .
Updated .
Reported affected releases: 4.4.0, 4.4.0-preview1-25305-02, 4.4.0-preview2-25405-01, 4.4.1.
Affected ranges: introduced 0, fixed 4.4.2.
Fix versions reported by the advisory: 4.4.2.
Severity: HIGH.
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Published .
Updated .
Reported affected releases: 4.4.0, 4.4.0-preview1-25305-02, 4.4.0-preview2-25405-01, 4.4.1.
Affected ranges: introduced 0, fixed 4.4.2.
Fix versions reported by the advisory: 4.4.2.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.6; introduced 9.0.0, fixed 9.0.15; introduced 8.0.0, fixed 8.0.3.
Fix versions reported by the advisory: 10.0.6, 9.0.15, 8.0.3.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.6; introduced 9.0.0, fixed 9.0.15; introduced 8.0.0, fixed 8.0.3.
Fix versions reported by the advisory: 10.0.6, 9.0.15, 8.0.3.
Severity: HIGH.
.NET Information Disclosure Vulnerability
Published .
Updated .
Reported affected releases: 4.4.0, 4.4.0-preview1-25305-02, 4.4.0-preview2-25405-01, 4.4.1, 4.4.2, 4.5.0, 4.5.0-preview1-25914-04, 4.5.0-preview1-26216-02, 4.5.0-preview2-26406-04, 4.5.0-rc1, 4.6.0, 4.7.0, 5.0.0, 6.0.0.
Affected ranges: introduced 0, fixed 4.7.1; introduced 5.0.0, fixed 6.0.1.
Fix versions reported by the advisory: 4.7.1, 6.0.1.
Severity: MEDIUM.
Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.6; introduced 9.0.0, fixed 9.0.15; introduced 8.0.0, fixed 8.0.3.
Fix versions reported by the advisory: 10.0.6, 9.0.15, 8.0.3.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.4.
Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.4.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.4.
Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.4.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.4.
Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.4.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.4.
Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.4.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 8.0.0, fixed 8.0.5; introduced 9.0.0, fixed 9.0.21.
Fix versions reported by the advisory: 10.0.13, 11.0.0-rc.2, 8.0.5, 9.0.21.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 8.0.0, fixed 8.0.5; introduced 9.0.0, fixed 9.0.21.
Fix versions reported by the advisory: 10.0.13, 11.0.0-rc.2, 8.0.5, 9.0.21.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 8.0.0, fixed 8.0.5; introduced 9.0.0, fixed 9.0.21.
Fix versions reported by the advisory: 10.0.13, 11.0.0-rc.2, 8.0.5, 9.0.21.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
Published .
Updated .
Reported affected releases: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4.
Affected ranges: introduced 8.0.0, fixed 8.0.5.
Fix versions reported by the advisory: 8.0.5.
Severity: HIGH.
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
Published .
Updated .
Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.4.
Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.4.
Severity: CRITICAL.
Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.