CVE-2026-96960: CWE-405: Asymmetric Resource Consumption (Amplification) in Microsoft Microsoft .NET Framework 3.5

This vulnerability, identified as CWE-405 (Asymmetric Resource Consumption), affects the System.Security.Cryptography.Xml package used in Microsoft .NET Framework 3.5 and later versions. The flaw allows an attacker to cause excessive resource consumption during XML cryptographic operations, potentially resulting in denial of service. The vulnerability impacts all architectures on Windows, Linux, and macOS platforms. Microsoft has released patched versions of the affected packages (e.g., System.Security.Cryptography.Xml versions 10.0.13, 11.0.0-rc.2, 8.0.5, and 9.0.21) and advises updating .NET SDKs and runtimes accordingly. Self-contained applications targeting vulnerable versions must be recompiled and redeployed to be secure.

The vulnerability can lead to denial of service (DoS) by causing excessive resource consumption during XML cryptographic processing. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating remote exploitation without privileges or user interaction is possible, resulting in availability impact.

An official fix is available. Users should update to the patched versions of System.Security.Cryptography.Xml packages as listed by Microsoft (e.g., 10.0.13, 11.0.0-rc.2, 8.0.5, 9.0.21). Additionally, update the .NET runtime and SDK to the latest versions and restart applications for changes to take effect. Self-contained applications must be recompiled and redeployed with the updated packages. Follow guidance from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960.