Key points
- CVE-2026-84008 allows unauthenticated remote attackers to exhaust CPU resources via malformed X.509 data.
- The flaw affects .NET versions 8, 9, 10 and 11, with patched NuGet packages now available for each stream.
- Microsoft rates the vulnerability as high severity with a CVSS score of 7.5 due to inefficient algorithmic complexity.
Microsoft has released updates for a denial of service vulnerability in the System.Security.Cryptography.Pkcs library. The flaw, tracked as CVE-2026-84008, enables unauthenticated attackers to cause quadratic CPU exhaustion by sending malformed X.509 data to affected applications.
What happened
The vulnerability stems from inefficient algorithmic complexity in how the library processes cryptographic signatures. According to the GitHub advisory GHSA-846f-f764-76mx, the SignedCms.CheckSignature method can repeatedly reparse attacker-controlled X.509 data. This behaviour leads to significant CPU consumption without requiring authentication. Microsoft classifies the issue as high severity under CVSS version 3.1, assigning it a score of 7.5. The vector string indicates network accessibility and low attack complexity.
The flaw impacts .NET projects running on Windows, Linux and macOS across all architectures. It specifically affects the System.Security.Cryptography.Pkcs NuGet package. Versions 8.0.0 through 8.0.1 are vulnerable, as are versions 9.0.0 through 9.0.20. The issue also extends to version 10.0.0 through 10.0.12 and version 11.0.0-preview.1 through 11.0.0-rc.1.
Why it matters
Organisations using these specific package versions face exposure to remote denial of service attacks. The unauthenticated nature of the exploit means attackers do not need credentials to trigger the resource exhaustion. This can disrupt services relying on cryptographic signature verification. The widespread use of .NET in enterprise environments increases the potential attack surface.
Microsoft confirms that patched versions are now available for all affected streams. Version 8.0.2, 9.0.21, 10.0.13 and 11.0.0-rc.2 address the vulnerability. The advisory notes that developers should update their applications to remove the risk. The fix involves correcting the parsing logic to prevent repeated reparsing of data.
What happens next
- Identify all applications using the System.Security.Cryptography.Pkcs package in your deployment pipeline.
- Check current package versions against the affected ranges listed in the advisory.
- Update to the patched versions: 8.0.2, 9.0.21, 10.0.13 or 11.0.0-rc.2.
- Verify that updated packages are correctly referenced in production environments.
Patch priority
Teams should prioritise updating systems that expose cryptographic validation endpoints to untrusted networks. Begin by identifying applications that process external X.509 certificates or signatures without prior authentication. Test updates in isolated environments to ensure compatibility before rolling them out broadly. Back up current configurations to allow rapid rollback if issues arise. Monitor system resource usage during the update process to detect any anomalies. Focus on internet-facing services first, as they present the highest risk of unauthenticated exploitation.
What to do and how to stay safe: Microsoft
- Audit your NuGet package dependencies to locate any instances of System.Security.Cryptography.Pkcs within the affected version ranges.
- Implement network-level controls to limit access to services that process cryptographic data from untrusted sources.
- Monitor CPU utilisation metrics on servers running .NET applications for sudden spikes that may indicate exploitation attempts.
- Ensure your build pipelines enforce the use of patched package versions to prevent regression to vulnerable states.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-84008?
Versions 8.0.0 to 8.0.1, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.
Is there a fix available for this vulnerability?
Yes, Microsoft has released patched versions: 8.0.2, 9.0.21, 10.0.13, and 11.0.0-rc.2.
What is the severity rating for CVE-2026-84008?
Microsoft rates the vulnerability as high severity with a CVSS 3.1 score of 7.5.
