GHSA-rr3c-f55v-qhv5 CVE-2018-0764
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 8.88%
- Chance of exploitation in the next 30 days. Higher than 95.22% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
4.4.2- Upgrade System.Security.Cryptography.Xml to this version or later
Description
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| System.Security.Cryptography.Xml | < 4.4.2 |
4.4.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
System.Security.Cryptography.Xml NuGet → 4.4.2
- dotnet
dotnet add package System.Security.Cryptography.Xml --version 4.4.2
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7hqp-7c5m-4vq6 Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-c399-9853-6jmj Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-r955-8q5j-3h83 Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-vrv5-2jg9-4mmr Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-23rf-6693-g89p Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-mmjf-rqrv-855v Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-8q5v-6pqq-x66h Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability | High | Also affects System.Security.Cryptography.Xml |
| GHSA-g8r8-53c2-pm3f Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability | Critical | Also affects System.Security.Cryptography.Xml |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor