GHSA-35hc-x2cw-2j4v CVE-2018-0765

Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents

High NuGet

Severity: 7.5 / 10; High · CVSS 3.0
Exploit chance (EPSS): 8.12%; Chance of exploitation in the next 30 days. Higher than 94.84% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-611 Improper Restriction of XML External Entity Reference
Fix: 4.4.2; Upgrade System.Security.Cryptography.Xml to this version or later

Description

A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.

Affected versions

NuGet

Package	Vulnerable	Fixed in
System.Security.Cryptography.Xml	`< 4.4.2`	`4.4.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

System.Security.Cryptography.Xml NuGet → `4.4.2`

dotnet

dotnet add package System.Security.Cryptography.Xml --version 4.4.2

Severity breakdown

CVSS 3.0 7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it

Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

References

Advisories

Timeline

Oct 16, 2018 Published
Nov 8, 2023 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-7hqp-7c5m-4vq6 Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-c399-9853-6jmj Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-r955-8q5j-3h83 Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-vrv5-2jg9-4mmr Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-23rf-6693-g89p Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-mmjf-rqrv-855v Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-8q5v-6pqq-x66h Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability	High	Also affects System.Security.Cryptography.Xml
GHSA-g8r8-53c2-pm3f Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability	Critical	Also affects System.Security.Cryptography.Xml

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor