Key points
- CVE-2026-58280 is rated high severity with a CVSS score of 7.5.
- Patches are available for .NET versions 8, 9, 10 and pre-release 11.
- The flaw affects Windows, Linux and macOS systems using affected runtimes.
Microsoft has released security updates for .NET to address a denial of service vulnerability tracked as CVE-2026-58280. The flaw allows unauthorised network attackers to crash services by triggering uncontrolled recursion.
What happened
An uncontrolled recursion weakness in System.Security.Cryptography.Xml and System.Private.Xml enables remote denial of service attacks. According to Microsoft, an attacker can exploit this over a network without authentication. The issue stems from how the libraries handle signed XML and entity references.
The vulnerability is classified as high severity with a CVSS 3.1 score of 7.5. It affects all architectures on Windows, Linux and macOS. The flaw is mapped to CWE-674, indicating uncontrolled recursion as the root cause.
Why it matters
Organisations running .NET applications that process XML or use cryptographic signatures are exposed. The vulnerability impacts Microsoft.NETCore.App.Runtime packages across multiple operating systems. Attackers can cause service outages by sending crafted requests that trigger infinite loops.
Patches are available for .NET 8, 9, 10 and 11 preview builds. Version 8 requires update 8.0.32, while version 9 needs 9.0.21. Version 10 users must apply 10.0.13, and version 11 preview users need 11.0.0-rc.2.
What happens next
- Identify all systems running vulnerable .NET runtime versions.
- Download the patched packages from NuGet or package managers.
- Test the updates in non-production environments first.
- Deploy the fixes to production systems according to change windows.
Patch priority
Security teams should prioritise systems that accept external XML input or handle cryptographic signatures. Exposed web services and API endpoints require immediate attention. Teams usually isolate critical assets before applying runtime updates to verify stability. Back up configuration files and application states prior to deployment. Monitor logs for recursion errors after the update to confirm the fix is active.
What to do and how to stay safe: .NET
- Audit your inventory for .NET runtime versions 8 through 11.
- Check if your applications parse XML or use cryptographic signatures.
- Apply the specific patched versions listed in the advisory.
- Monitor application logs for signs of recursion or crashes.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-58280?
Versions 8, 9, 10 and 11 preview builds are affected.
Is there a patch available for this vulnerability?
Yes, patches are available for all affected versions.
What platforms are impacted by this flaw?
Windows, Linux and macOS systems are all impacted.
