CVE-2026-33116: .NET System.Security.Cryptography.Xml DoS

System.Security.Cryptography.Xml contains a denial-of-service vulnerability across multiple release trains. Live GHAD GHSA-37gx-xxp4-5rgx first_patched the NuGet package at 8.0.3 / 9.0.15 / 10.0.6. NVD is Modified. NVD CPE excludes .NET runtime 8.0.26 / 9.0.15 / 10.0.6 and exact-affects .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 / 4.8.1 with no Framework floor. 8.0.3 is not an NVD runtime exclude. Do not invent a Framework floor. CISA has not listed this CVE.

When to use it

• A .NET solution directly or transitively resolves a vulnerable System.Security.Cryptography.Xml package version.
• Central package management, lockfiles, or multiple runtime trains make the effective package version hard to see from a single project file.
• XML signature, SAML, WS-Security, document verification, or inbound XML processing can reach untrusted or partner-supplied XML.
• You need a bounded dependency remediation PR or a triage note naming blocked projects, owners, and containment.

Inputs

• *.csproj, Directory.Packages.props, packages.lock.json, solution files, container files, SBOMs, and generated dependency reports.
• Runtime train for each project and the effective resolved package versions.
• XML signature, SAML, WS-Security, document verification, or partner XML entry points owned by the repository.
• Available dotnet restore, dotnet list package --include-transitive, build, test, container, SBOM, and dependency scan commands.

Affected versions

• Fixed / GHAD first_patched: NuGet System.Security.Cryptography.Xml 8.0.3 / 9.0.15 / 10.0.6.
• Vulnerable / NVD CPE: .NET runtime >= 8.0.0 excludes 8.0.26, >= 9.0.0 excludes 9.0.15, >= 10.0.0 excludes 10.0.6. Framework exact last-affects 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 / 4.8.1 with no exclude.
• Do not invent: flatten leftover GHAD 8.0.3 onto NVD runtime 8.0.26, or invent a Framework floor.

Indicator-of-exposure

You are exposed if any project in the solution directly or transitively resolves a vulnerable version.

Quick checks:

dotnet list package --include-transitive | grep -i System.Security.Cryptography.Xml

Remediation strategy

1. Upgrade the package to a patched version for each runtime train in use: - .NET 8 -> 8.0.3+ - .NET 9 -> 9.0.15+ - .NET 10 -> 10.0.6+
2. Refresh lockfiles / central package management references.
3. Rebuild and redeploy all affected services.
4. Prefer aligning SDK/runtime baselines with patched lines.

The prompt

You are remediating CVE-2026-33116 in a .NET repository.

Output exactly one of:
- A PR that upgrades vulnerable package versions and updates
  all dependency state files, or
- TRIAGE.md with concrete blockers and containment.

## Step 0 - Detect
1. Enumerate all `*.csproj`, `Directory.Packages.props`, and
   `packages.lock.json` references to
   `System.Security.Cryptography.Xml`.
2. Determine the runtime train (8/9/10) for each project.

## Step 1 - Remediate
1. Upgrade to minimum patched versions per train:
   8.0.3 / 9.0.15 / 10.0.6 (or newer compatible).
2. Regenerate lockfiles and central package references.

## Step 2 - Verify
1. `dotnet list package --include-transitive` shows no
   vulnerable versions.
2. Build/test pipelines pass for all touched projects.

## Stop conditions
- Upgrade introduces unresolved compile/runtime breakage.
- Runtime train is pinned by an external dependency and cannot
  be updated safely this sprint.

If stopped, write TRIAGE.md with blocked projects,
short-term containment, owner, and follow-up date.

Verification - what the reviewer looks for

• Dependency output shows no vulnerable versions.
• Updated lockfiles are committed.
• CI validates build and tests after remediation.
• Operator notes cite the GHAD first_patched NuGet floors and the NVD runtime 8.0.26 split, and do not invent a Framework floor.

Rollback

Do not roll back into the GHAD first_patched NuGet range below 8.0.3, 9.0.15, or 10.0.6, or into NVD runtime 8.x before 8.0.26. Do not flatten leftover 8.0.3 onto the runtime and do not invent a Framework floor.

Output contract

• Reviewer-ready PR upgrading every controlled runtime train to a patched System.Security.Cryptography.Xml version and refreshing lockfiles or central package references.
• Evidence showing no direct or transitive project still resolves a vulnerable package version.
• Operator notes naming affected services, XML processing surfaces, redeploy needs, and any blocked runtime train.
• TRIAGE.md when a runtime train, transitive pin, or external dependency prevents safe remediation in this repository.

Watch for

• Multiple projects in one solution pinned to different trains.
• Central package management overriding project-level updates.
• Stale lockfiles masking effective package resolution.

Related recipes

• Vulnerable dependency remediation
• SAST finding triage and fix
• CVE intelligence intake gate

References

• GitHub Advisory: https://github.com/advisories/GHSA-37gx-xxp4-5rgx
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33116