CVE-2026-69651: CWE-407: Inefficient Algorithmic Complexity in Microsoft .NET 10.0
Description
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS v3.1
Score 7.5high
Affected software
Microsoft
.NET 10.0
Microsoft
.NET 11.0
Microsoft
.NET 8.0
Microsoft
.NET 9.0
Microsoft
Microsoft .NET Framework 3.5
Microsoft
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft
Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft
Microsoft .NET Framework 3.5 AND 4.8
Microsoft
Microsoft .NET Framework 3.5 AND 4.8.1
Microsoft
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft
Microsoft .NET Framework 4.8
Microsoft
Microsoft .NET Framework 4.8.1
Microsoft
Microsoft Visual Studio 2022 version 17.14
Microsoft
Microsoft Visual Studio 2026 version 18.10
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-69651) in Microsoft .NET 10.0 relates to inefficient algorithmic complexity in the XML cryptography libraries (System.Security.Cryptography.Xml and System.Private.Xml). The issue allows crafted XML inputs to cause excessive resource consumption, resulting in denial of service. The fix involves adding input-depth and operation-count limits, disabling DTD processing by default, validating entity references, and bounding processing of encrypted data and canonicalization transforms. It affects multiple runtime packages across Windows, Linux, and macOS platforms. Official patches have been released in versions 9.0.21, 11.0.0-rc.2, and others, mitigating the vulnerability.
Potential Impact
The vulnerability can cause denial of service by exploiting inefficient algorithmic complexity in XML processing components, impacting application availability. There is no impact on confidentiality or integrity reported. The vulnerability is rated high severity with a CVSS score of 7.5.
Mitigation Recommendations
An official fix is available and should be applied by updating to the patched versions listed by Microsoft (e.g., 9.0.21, 11.0.0-rc.2). Developers should update their applications to use these fixed versions. The vendor advisory provides detailed guidance and the patches fully mitigate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- microsoft
- Date Reserved
- 2026-08-03T21:24:59.409Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
- Vendor Advisory Urls
- [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69651","vendor":"Microsoft"}]
Threat ID: 6ace84ab2cdf04f6569f0c4f
Added to database: 10/13/2026, 19:21:15 UTC
Last enriched: 10/13/2026, 21:58:40 UTC
Last updated: 10/13/2026, 22:50:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.