.NET Recursion Flaw CVE-2026-58280 Risks Service Outages Across Platforms
A high-severity uncontrolled recursion flaw in Microsoft .NET allows remote attackers to deny service. Patches are now available for versions 8, 9, 10 and 11.
Key points
- CVE-2026-58280 is a high-severity denial-of-service vulnerability in Microsoft .NET.
- The flaw stems from uncontrolled recursion in XML processing components.
- Microsoft has released updates for .NET 8, 9, 10 and preview builds of 11.
Microsoft has addressed a high-severity denial-of-service vulnerability in its .NET framework that could allow remote attackers to crash services. The flaw, tracked as CVE-2026-58280, arises from uncontrolled recursion within the System.Security.Cryptography.Xml and System.Private.Xml libraries. According to the Microsoft Security Update Guide, an unauthorised attacker can exploit this issue over a network to disrupt availability. The company rates the severity as high, with a CVSS score of 7.5. This reflects the ease of exploitation and the significant impact on system availability.
How it unfolded
- Microsoft identified uncontrolled recursion in XML processing libraries that could lead to service denial.
- The vendor published advisory details including CVSS 3.1 metrics and affected package ranges.
- Updates were released for multiple .NET versions to introduce recursion limits and input validation.
Who is affected
Applications built on Microsoft .NET versions 8, 9, 10 and early previews of 11 are vulnerable if they use affected runtime packages. The issue spans Windows, Linux and macOS operating systems, covering architectures including x64, x86, arm and arm64. According to the GitHub advisory, any project utilising the Microsoft.NETCore.App.Runtime packages within the specified vulnerable version ranges is at risk. The flaw is present in both standard and musl-based Linux runtimes, as well as macOS and Windows environments. Developers using these frameworks for XML processing must verify their current package versions against the advisory lists.
The fix
Microsoft has released patched versions of the affected runtime packages to mitigate the risk. For .NET 8, users should update to version 8.0.32 or later. Those on .NET 9 must upgrade to 9.0.21 or newer. .NET 10 users need version 10.0.13 or higher. Preview users of .NET 11 should move to 11.0.0-rc.2 or later. According to the advisory, these fixes add input-depth and operation-count limits, prohibit DTD processing by default and validate entity references. They also bound encrypted-data candidate processing and cap attributes and namespaces used by C14N transforms.
What analysts watch for
Teams usually monitor for sudden spikes in CPU usage or memory consumption on servers handling XML data. Analysts check whether applications are crashing unexpectedly when processing complex or nested documents. They examine logs for signs of deep recursion loops or stack overflow errors triggered by remote inputs. Security staff often review network traffic for unusually large or deeply structured XML payloads sent to public-facing endpoints. They also verify that applications enforce strict schema validation and limit processing depth to prevent resource exhaustion attacks.
Background: Input validation
Input validation checks whether data meets strict format rules before processing. Sanitisation modifies data to remove dangerous characters after acceptance. Validation prevents unexpected input types. Sanitisation neutralises embedded commands. You need both because validation fails on complex formats, while sanitisation alone allows structural abuse of the application logic.
Read the full guide: Input Validation vs Sanitisation: Difference and How to Apply Both
What to do and how to stay safe: Microsoft
- Audit your .NET applications to identify which runtime versions are currently in use.
- Update all affected Microsoft.NETCore.App.Runtime packages to the latest patched versions.
- Monitor application logs for recursion-related errors or unexpected service interruptions.
- Restrict XML processing inputs to trusted sources where possible to reduce exposure.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-58280?
It is a high-severity denial-of-service vulnerability in Microsoft .NET caused by uncontrolled recursion in XML processing libraries.
Which .NET versions are affected?
Versions 8, 9, 10 and preview builds of 11 are affected, specifically those below the patched versions listed in the advisory.
Is there a patch available?
Yes, Microsoft has released patched versions for all affected .NET releases, including 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2.
