PT-2026-32748 · Microsoft+4 · System.Security.Cryptography.Xml+4

Ludvig Pedersen · Publicado 2026-04-14 · Atualizado 2026-06-08 · CVE-2026-26171

Positive Technologies (AI Summary) · Pt

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions System.Security.Cryptography.Xml versões 10.0.0 até 10.0.5 System.Security.Cryptography.Xml versões 9.0.0 até 9.0.14 System.Security.Cryptography.Xml versões 8.0.0 até 8.0.2

Description O consumo descontrolado de recursos na classe EncryptedXml permite que um invasor não autorizado realize um ataque de Negação de Serviço através de uma rede.

Recommendations Atualizar System.Security.Cryptography.Xml versões 10.0.0 até 10.0.5 para a versão 10.0.6. Atualizar System.Security.Cryptography.Xml versões 9.0.0 até 9.0.14 para a versão 9.0.15. Atualizar System.Security.Cryptography.Xml versões 8.0.0 até 8.0.2 para a versão 8.0.3.

Correção

DoS

Resource Exhaustion

XXE

Enumeração de Fraquezas

CWE-400

CWE-611

Identificadores relacionados

ALSA-2026:8468

ALSA-2026:8469

ALSA-2026:8470

ALSA-2026:8472

ALSA-2026:8473

ALSA-2026:8475

BDU:2026-05498

BIT-DOTNET-2026-26171

BIT-DOTNET-SDK-2026-26171

BIT-POWERSHELL-2026-26171

CVE-2026-26171

GHSA-W3X6-4M5H-CXQF

RHSA-2026:13280

RHSA-2026:13281

RHSA-2026:13282

RHSA-2026:13283

RHSA-2026:13693

RHSA-2026:8467

RHSA-2026:8468

RHSA-2026:8469

RHSA-2026:8470

RHSA-2026:8471

RHSA-2026:8472

RHSA-2026:8473

RHSA-2026:8474

RHSA-2026:8475

RHSA-2026:9077

RHSA-2026:9080

RHSA-2026:9205

USN-8176-1

USN-8216-1

Produtos afetados

Linuxmint

Red Os

Rocky Linux

System.Security.Cryptography.Xml

Ubuntu

Referências · 72

• https://github.com/dotnet/runtime · Nota
• https://github.com/dotnet/runtime/security/advisories/GHSA-w3x6-4m5h-cxqf · Nota
• https://github.com/dotnet/announcements/issues/389 · Nota
• https://errata.almalinux.org/8/ALSA-2026-8473.html · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2026-8473.html · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2026:8473 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w3x6-4m5h-cxqf · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2026:8469 · Aviso do Fabricante
• https://twitter.com/giuseppe_1337/status/2047869523110355387 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2026-32203 · Nota
• https://access.redhat.com/errata/RHSA-2026:8475 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-dotnet8-0-cve-2026-26171-8.0 · Nota
• https://linux.oracle.com/errata/ELSA-2026-8475.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8216-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/2457739 · Nota