Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

🗓️ 14 Apr 2026 23:30:27Reported by GitHub Advisory DatabaseType

Security advisory: Denial of Service in System.Security.Cryptography.Xml EncryptedXml infinite loop.

Reporter	Title	Published	Views	Family All 231
ATTACKERKB	CVE-2026-33116	14 Apr 202616:57	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-1627)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-1628)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-1629)	30 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : .NET 8.0 (ALSA-2026:8468)	20 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : .NET 8.0 (ALSA-2026:8469)	17 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : .NET 8.0 (ALSA-2026:8470)	21 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : .NET 9.0 (ALSA-2026:8472)	21 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : .NET 10.0 (ALSA-2026:8473)	20 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : .NET 9.0 (ALSA-2026:8475)	20 Apr 202600:00	–	nessus

Vulners

Node

system.security.cryptography.xmlRange8.0.0–8.0.2nuget

system.security.cryptography.xmlRange9.0.0–9.0.14nuget

system.security.cryptography.xmlRange10.0.0–10.0.5nuget

Source	Link
github	www.github.com/dotnet/runtime/security/advisories/GHSA-37gx-xxp4-5rgx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33116
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116
github	www.github.com/dotnet/announcements/issues/392
github	www.github.com/advisories/GHSA-37gx-xxp4-5rgx

17 Apr 2026 13:19Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

EPSS0.08014

SSVC