Bug 2551004 (CVE-2026-96960)

Summary:	CVE-2026-96960 dotnet: .NET: Denial of Service via asymmetric resource consumption
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in .NET. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted network requests that trigger asymmetric resource consumption, causing the system to expend disproportionate processing resources. Successful exploitation leads to a Denial of Service (DoS), rendering the affected application or service unavailable to legitimate users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 19:48:52 UTC

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Affected packages:
- System.Security.Cryptography.Xml (release 10.0): 10.0.0 - 10.0.12; fixed 10.0.13
- System.Security.Cryptography.Xml (release 8.0): 8.0.0 - 8.0.4; fixed 8.0.5
- System.Security.Cryptography.Xml (release 9.0): 9.0.0 - 9.0.20; fixed 9.0.21
- System.Security.Cryptography.Xml (release 11.0): 11.0.0-preview.1 - 11.0.0-rc.1; fixed 11.0.0-rc.2