CVE-2026-26171: 
C# vulnerability analysis and mitigation

CVE-2026-26171 is a Denial of Service vulnerability in the System.Security.Cryptography.Xml library's EncryptedXml class, caused by uncontrolled resource consumption via XML entity expansion. Disclosed on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday, it affects Microsoft .NET 8.0 (before 8.0.26), .NET 9.0 (before 9.0.15), and .NET 10.0 (before 10.0.6), as well as PowerShell 7.5 (before 7.5.6) and 7.6 (before 7.6.1). The vulnerability was credited to researcher Ludvig Pedersen. It carries a CVSS v3.1 base score of 7.5 (High) (MSRC Advisory, GitHub Advisory).

The vulnerability is rooted in improper handling of XML input within the EncryptedXml class of the System.Security.Cryptography.Xml NuGet package, classified under CWE-400 (Uncontrolled Resource Consumption), CWE-611 (Improper Restriction of XML External Entity Reference), and CWE-776 (Improper Restriction of Recursive Entity References in DTDs — XML Entity Expansion). An unauthenticated, remote attacker can craft a malicious XML payload — such as a "Billion Laughs"-style entity expansion attack — and submit it to any .NET application that processes XML using the affected class, causing excessive CPU and memory consumption. No authentication, privileges, or user interaction are required to trigger the vulnerability. The attack maps to CAPEC patterns including XML Ping of the Death (CAPEC-147), Exponential Data Expansion (CAPEC-197), and Data Serialization External Entities Blowup (CAPEC-221) (GitHub Advisory, MSRC Advisory).

Successful exploitation causes denial of service by exhausting CPU and memory resources on the affected host, potentially crashing the application or rendering it unresponsive. The impact is limited to availability — there is no confidentiality or integrity impact, and lateral movement is not a direct consequence. Internet-facing .NET applications that accept and process XML input are at highest risk, as unauthenticated attackers can trigger the condition remotely without any user interaction (GitHub Advisory, MSRC Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.76–3.08% (varying by source), placing it in the upper percentiles for exploitation probability within 30 days relative to other CVEs. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate internet-facing .NET 8.0, 9.0, or 10.0 applications that accept XML input and use the System.Security.Cryptography.Xml package (e.g., applications performing XML decryption via EncryptedXml).
2. Craft malicious XML payload: Construct an XML document containing deeply nested or recursive entity references (e.g., a "Billion Laughs" DTD entity expansion) designed to cause exponential resource consumption when parsed by the EncryptedXml class.
3. Submit payload: Send the crafted XML payload to the target application's XML-processing endpoint via HTTP or another network protocol, without requiring authentication.
4. Trigger resource exhaustion: The EncryptedXml class processes the malicious XML, causing uncontrolled CPU and memory consumption on the server, leading to application crash or denial of service (GitHub Advisory, MSRC Advisory).

• Network: Unusual spikes in inbound XML payloads to application endpoints; large or deeply nested XML documents submitted to services using System.Security.Cryptography.Xml.
• System Resources: Sudden and sustained CPU or memory exhaustion on .NET application servers without a corresponding increase in legitimate traffic.
• Logs: Application logs showing repeated XML parsing errors, timeouts, or out-of-memory exceptions originating from System.Security.Cryptography.Xml.EncryptedXml; .NET runtime crash dumps referencing XML processing.
• Process: .NET worker processes (e.g., dotnet.exe, w3wp.exe) consuming abnormally high CPU or memory, potentially leading to process termination or restart.

Microsoft released patched versions on April 14, 2026: update the System.Security.Cryptography.Xml NuGet package to version 8.0.3 (for .NET 8), 9.0.15 (for .NET 9), or 10.0.6 (for .NET 10). The corresponding .NET runtime updates are .NET 8.0.26, .NET 9.0.15, and .NET 10.0.6; PowerShell users should update to 7.5.6 or 7.6.1. Developers can update the NuGet package directly via Visual Studio's Package Manager, the Package Manager Console (Update-Package -Id System.Security.Cryptography.Xml), or the .NET CLI (dotnet add package System.Security.Cryptography.Xml), followed by recompilation and redeployment. As interim mitigations, implement network-level controls to restrict XML payload sizes, validate and sanitize XML input before processing, and monitor for unusual resource consumption in .NET applications (GitHub Advisory, MSRC Advisory).

The vulnerability was covered as part of Microsoft's large April 2026 Patch Tuesday release, which addressed 167 flaws. Security outlets including BleepingComputer, Zero Day Initiative, and Rapid7 included it in their Patch Tuesday roundups, though it did not receive individual spotlight coverage given its DoS-only impact. HeroDevs published a dedicated technical blog post explaining the EncryptedXml DoS vulnerability and remediation steps for .NET developers. Red Hat, Ubuntu, Rocky Linux, and AlmaLinux all issued downstream advisories and errata for their .NET packages (BleepingComputer, ZDI Blog, HeroDevs Blog).