.NET Uncontrolled Recursion Flaw CVE-2026-58280 Patches Available
Microsoft releases fixes for a high-severity denial of service bug in .NET runtimes across Windows, Linux and macOS platforms.
Key points
- The flaw allows remote attackers to trigger uncontrolled recursion via network requests.
- Patched versions are available for .NET 8, 9, 10 and 11 runtimes on all major operating systems.
- The vulnerability is rated high severity with a CVSS score of 7.5.
Microsoft has published security updates to address a denial of service vulnerability in its .NET framework. The issue affects multiple runtime versions across Windows, Linux and macOS environments.
What happened
The Microsoft Security Update Guide describes CVE-2026-58280 as an uncontrolled recursion flaw in .NET. This weakness allows an unauthorised attacker to deny service over a network. The issue resides in System.Security.Cryptography.Xml and System.Private.Xml components.
According to GitHub advisory GHSA-mc4q-93x5-f6hj, the bug permits remote exploitation without authentication. Attackers can send crafted requests that trigger infinite loops within the XML processing logic. This results in application crashes or unresponsiveness.
Why it matters
The vulnerability carries a high severity rating with a CVSS 3.1 score of 7.5. It impacts .NET 8, 9, 10 and 11 runtimes on all architectures. Versions up to 8.0.31, 9.0.20, 10.0.12 and 11.0.0-rc.1 are affected.
Organisations using these runtimes for web services or APIs are exposed. The flaw enables remote denial of service without requiring user interaction. That suggests any internet-facing .NET service could be targeted by automated scanners or malicious actors.
Next steps
- Update .NET 8 runtimes to version 8.0.32 or later.
- Upgrade .NET 9 runtimes to version 9.0.21 or later.
- Apply .NET 10 updates to version 10.0.13 or later.
- Move .NET 11 preview builds to 11.0.0-rc.2 or later.
Detection notes
Teams usually observe sudden spikes in CPU usage or memory consumption on affected servers. Application logs may show repeated XML parsing errors or stack overflow exceptions. Check whether services become unresponsive after handling specific requests. Monitor for unusual network traffic patterns targeting XML endpoints. First containment moves include isolating affected instances and blocking suspicious source IPs. Review access logs for repeated failed connection attempts. Ensure logging captures request payloads to identify malicious XML structures. Verify that monitoring tools alert on abnormal process behaviour.
What to do and how to stay safe: Microsoft
- Audit all .NET applications for vulnerable runtime versions.
- Apply available patches to affected systems as soon as possible.
- Monitor application logs for signs of XML processing failures.
- Restrict network access to critical services where feasible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-58280?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12 and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.
Is there a patch available for this vulnerability?
Yes, patched versions 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2 are available for all affected platforms.
What is the severity rating of this flaw?
The vulnerability is rated high severity with a CVSS 3.1 score of 7.5.
