GitHub Security Advisory: GHSA-37gx-xxp4-5rgx
Package: System.Security.Cryptography.Xml (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: >= 9.0.0, <= 9.0.14
Patched in: 9.0.15

Summary: Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability 

Details:
## Executive Summary: 

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/392

## CVSS Details

- **Version:** 3.1
- **Severity:** High
- **Score:** 7.5
- **Vector:** 7.5 CVSS: 3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
- **Weakness:** CWE-835 CWE-400 CWE-20: Loop with Unreachable Exit Condition ('Infinite Loop') Uncontrolled Resource Consumption Improper Input Validation

## Affected Platforms

- **Platforms:** All
- **Architectures:** All

## <a name="affected-packages"></a>Affected Packages
The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

### <a name=".NET 10"></a>.NET 10
Package name | Affected version | Patched version
------------ | ---------------- | -------------------------
[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml)               | >=10.0.0, <=10.0.5 | 10.0.6

### <a name=".NET 9"></a>.NET 9
Package name | Affected version | Patched version
------------ | ---------------- | -------------------------
[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml)               | >=9.0.0, <=9.0.14 | 9.0.15

### <a name=".NET 8"></a>.NET 8
Package name | Affected version | Patched version
------------ | ---------------- | -------------------------
[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml)               | >=8.0.0, <=8.0.2 | 8.0.3

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?

If using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.

### <a name="how-fix"></a>How do I fix the issue?

To update the Using the System.Security.Cryptography.xml NuGet package, use one of the following methods:

NuGet Package Manager UI in Visual Studio:
- Open your project in Visual Studio.
- Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages".
- In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources.
- Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.
- Click the "Update" button.

Using the NuGet Package Manager Console in Visual Studio:
- Open your project in Visual Studio.
- Navigate to "Tools > NuGet Package Manager > Package Manager Console".
- To update a specific pa