{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/microsoft.netcore.app.runtime.linux-x64-8.0.0-8.0.31-9.0.0-9.0.20-10.0.0-10.0.12-11.0.0-preview.1-11.0.0-rc.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-58280"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft.NETCore.App.Runtime.linux-arm (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.linux-arm64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.linux-musl-arm (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.linux-musl-arm64","Microsoft.NETCore.App.Runtime.linux-musl-x64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.linux-x64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.osx-arm64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.osx-x64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.win-arm (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.win-arm64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.win-x64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)","Microsoft.NETCore.App.Runtime.win-x86 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","denial-of-service","dotnet","cve-2026-58280"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft has disclosed a high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2026-58280, affecting the System.Security.Cryptography.Xml and System.Private.Xml components within Microsoft .NET. The vulnerability, classified as CWE-674 (Uncontrolled Recursion), allows an unauthenticated attacker to cause excessive resource consumption and application crashes by supplying specially crafted XML inputs to vulnerable services.\u003c/p\u003e\n\u003cp\u003eThe flaw exists in how the affected components handle XML processing, specifically related to entity references, DTD processing, and C14N transforms. By sending inputs designed to trigger deep recursion or inflate operation counts, an attacker can effectively disable services relying on these .NET libraries. Microsoft has addressed this in the latest .NET SDK and runtime releases by implementing stricter depth and operation count limits, disabling DTD processing by default, and validating entity references. Defenders must ensure all deployed .NET applications, including self-contained deployments, are updated to the patched versions to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service condition, rendering affected .NET-based applications or services unresponsive. The vulnerability is network-exploitable, requires no authentication, and impacts a wide range of .NET versions (8.0, 9.0, 10.0, and 11.0-preview branches) across Windows, Linux, and macOS platforms. Given the ubiquity of .NET in enterprise backend services and public-facing APIs, this vulnerability poses a significant risk to service availability if left unpatched.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all .NET environments to the latest runtime versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.\u003c/li\u003e\n\u003cli\u003eRecompile and redeploy all self-contained applications targeting any of the impacted versions listed in the advisory.\u003c/li\u003e\n\u003cli\u003eUse the 'dotnet --info' command to audit currently installed versions across all development and production servers.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for spikes in CPU usage or unexpected process terminations associated with XML parsing operations, which may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T00:33:03Z","date_published":"2026-10-14T00:33:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-net-xml-dos/","summary":"A denial-of-service vulnerability (CVE-2026-58280) in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml components allows attackers to crash applications via uncontrolled recursion and resource exhaustion.","title":"Denial of Service Vulnerability in .NET XML Components","url":"https://feed.craftedsignal.io/briefs/2026-10-net-xml-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Microsoft.NETCore.App.Runtime.linux-X64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-Preview.1-11.0.0-Rc.1)","version":"https://jsonfeed.org/version/1.1"}