.NET Pkcs Library Fixes CPU Exhaustion Bug Triggered by Malformed X.509 Data
Microsoft releases updates for System.Security.Cryptography.Pkcs to fix a quadratic CPU exhaustion bug triggered by malformed X.509 data.
Key points
- The flaw allows unauthenticated remote attackers to cause denial of service via inefficient algorithmic complexity.
- Affected .NET versions include 8.0, 9.0, 10.0 and early 11.0 preview releases.
- Patches are available for all listed vulnerable package ranges.
Microsoft has issued security updates to address a high-severity denial of service vulnerability in its .NET framework. The flaw exists within the System.Security.Cryptography.Pkcs package and affects applications processing cryptographic signatures.
What happened
An inefficiency in the algorithmic complexity of .NET allows an unauthorised attacker to deny service over a network, according to the Microsoft Security Update Guide. The issue stems from the SignedCms.CheckSignature method repeatedly reparsing attacker-controlled X.509 data. This behaviour causes unauthenticated quadratic CPU exhaustion on the affected system.
The vulnerability carries a CVSS score of 7.5, classified as high severity. It impacts Windows, Linux and macOS platforms across all architectures. The weakness is identified as CWE-407, inefficient algorithmic complexity.
Why it matters
Developers using specific versions of the System.Security.Cryptography.Pkcs NuGet package are exposed to this risk. Affected ranges include version 8.0.0 through 8.0.1, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12 and 11.0.0-preview.1 through 11.0.0-rc.1.
Any .NET project relying on these package versions is potentially vulnerable. The flaw does not require authentication, making it accessible to remote attackers. This exposes servers handling external certificate validation to resource exhaustion attacks.
Next steps
- Update System.Security.Cryptography.Pkcs to version 8.0.2 or later for .NET 8 applications.
- Upgrade to version 9.0.21 or later for .NET 9 environments.
- Move to version 10.0.13 or later for .NET 10 deployments.
- Install version 11.0.0-rc.2 or later for .NET 11 preview builds.
Detection notes
Teams usually monitor for sudden spikes in CPU utilisation on services handling certificate validation. Check whether logs show repeated parsing errors or timeouts in cryptographic libraries. Look for alerts indicating unauthenticated requests causing resource exhaustion. Isolate affected services to contain the impact while verifying package versions. Review network traffic for unusual patterns associated with malformed X.509 data submissions.
What to do and how to stay safe: Microsoft
- Audit your .NET applications to identify usage of the System.Security.Cryptography.Pkcs package.
- Verify the installed versions against the affected ranges listed in the advisory.
- Apply the patched package versions as soon as possible to mitigate risk.
- Monitor server performance metrics for signs of quadratic CPU exhaustion.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-84008?
Versions 8.0.0-8.0.1, 9.0.0-9.0.20, 10.0.0-10.0.12 and 11.0.0-preview.1-11.0.0-rc.1 are affected.
What is the severity of this vulnerability?
It is rated as high severity with a CVSS score of 7.5.
How can developers fix this issue?
Developers should install the latest patched versions of the System.Security.Cryptography.Pkcs package.
