high · 7.5CVE-2026-47302Jul 20, 2026

CVE-2026-47302: System.Security.Cryptography.Xml EncryptedXml Denial of Service

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A crafted XML document with deeply nested EncryptedData elements can make any .NET application that calls EncryptedXml.DecryptDocument() consume unbounded memory and CPU until it crashes.

PackageSystem.Security.Cryptography.Xml
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

The EncryptedXml class in System.Security.Cryptography.Xml processes XML encryption without any limit on nesting depth or total element count. An unauthenticated attacker can submit a small, valid-looking XML payload to any endpoint that calls DecryptDocument(), causing unbounded resource consumption.

The attack requires no credentials and no prior knowledge of the application. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that impact: full availability loss with zero attacker preconditions.

Proof of concept

A working proof-of-concept for CVE-2026-47302 in System.Security.Cryptography.Xml, with the exact payload below.

text
<?xml version="1.0" encoding="utf-8"?>
<root xmlns:enc="http://www.w3.org/2001/04/xmlenc#">
  <!-- Each nested EncryptedData causes a recursive decryption attempt.
       Repeat nesting to a depth of ~1000+ to exhaust stack/heap.
       The parser has no depth limit pre-patch. -->
  <enc:EncryptedData>
    <enc:CipherData>
      <enc:CipherValue>
        <!-- inner EncryptedData, repeated recursively -->
        <enc:EncryptedData>
          <enc:CipherData>
            <enc:CipherValue>
              <!-- ... continue nesting ... -->
            </enc:CipherValue>
          </enc:CipherData>
        </enc:EncryptedData>
      </enc:CipherValue>
    </enc:CipherData>
  </enc:EncryptedData>
</root>

Before the patch, EncryptedXml.DecryptDocument() recursively walked every EncryptedData node in the document without tracking depth or total work done. An attacker who controls XML input (for example, a SAML assertion, a SOAP body, or any other XML accepted over the network) can craft a document with arbitrarily many nested or chained EncryptedData elements, driving CPU and memory usage to the point of process termination.

CWE-770 applies directly: resources are allocated per node with no upper bound.

The July 2026 patch (10.0.10, 9.0.18, 8.0.29) adds a nesting-depth cap and restricts CipherReference transforms to a built-in allowlist, closing the allocation-without-limits path. No public PoC has been released; the payload above is derived from the patch diff behavior and the known W3C XML Encryption recursion attack pattern.

The fix

Update System.Security.Cryptography.Xml to 10.0.10 (for .NET 10), 9.0.18 (for .NET 9), or 8.0.29 (for .NET 8). Run: dotnet add package System.Security.Cryptography.Xml. Also update the .NET runtime to the matching patch-Tuesday release. If an emergency workaround is needed before patching, validate and reject abnormally large or deeply nested XML documents at the application boundary before passing them to DecryptDocument().

Reported by Levi Broderick.

References: [1][2][3][4][5][6]

Related research