Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents

HIGH 7.5CVE-2018-0764 · GHSA-rr3c-f55v-qhv5 · Published 10/01/2018 · updated 17/06/2026

In short

CVE-2018-0764 is a HIGH (CVSS 7.5) vulnerability affecting System.Security.Cryptography.Xml, .net core (microsoft), .net framework (microsoft).
Chance of exploitation in the next 30 days (EPSS): 8.9%, higher than 95.2% of all vulnerabilities.
Fix: update to 4.4.2 or later.

Package	Affected versions	Patched versions
System.Security.Cryptography.Xml NuGet	`< 4.4.2`	`4.4.2`
.net core microsoft	`= 1.0= 1.1= 2.0`	No fix yet
.net framework microsoft	`= 2.0= 3.0= 3.5= 3.5.1= 4.5.2= 4.6= 4.6.1= 4.6.2= 4.7= 4.7.1`	No fix yet
powershell core microsoft	`= 6.0`	No fix yet

Description

Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-0764 · ADVISORY
access.redhat.com/errata/RHSA-2018:0379 · WEB
GitHub Advisory GHSA-rr3c-f55v-qhv5 · ADVISORY
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0764 · WEB
securityfocus.com/bid/102387 · WEB
securitytracker.com/id/1040152 · WEB

More vulnerabilities in System.Security.Cryptography.Xml

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

System.Security.Cryptography.Xml

NuGet

< 4.4.2

4.4.2

.net core

microsoft

= 1.0= 1.1= 2.0

No fix yet

.net framework

microsoft

= 2.0= 3.0= 3.5= 3.5.1= 4.5.2= 4.6= 4.6.1= 4.6.2= 4.7= 4.7.1

No fix yet

powershell core

microsoft

= 6.0

No fix yet

Description

NVD description

More vulnerabilities in System.Security.Cryptography.Xml

See all →