Threat Advisory

System Security Cryptography Pkcs Vulnerability Permits Processing Disruption from Untrusted Input

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

A high-severity vulnerability affecting System.Security.Cryptography.Pkcs versions >= 10.0.0, <= 10.0.12 affecting System.Security.Cryptography.Pkcs versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 CVE-2026-84008 with a CVSS score of 7.5 exists in System.Security.Cryptography.Pkcs, allowing unauthenticated quadratic CPU exhaustion via repeated reparsing of attacker-controlled X.509 data by the SignedCms.CheckSignature function, leading to denial-of-service attacks on.NET projects using affected package versions across Windows, Linux, and macOS platforms with all architectures. This flaw is attributed to an inefficient algorithmic complexity in the vulnerable component. The business impact of this vulnerability is significant due to potential downtime and resource consumption, emphasizing the need for prompt updates to remove this vulnerability. Affected.NET projects can be identified by referencing the impacted package versions listed in the advisory, which include specific version ranges for System.Security.Cryptography.Pkcs across multiple branches.[/subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

A high-severity vulnerability affecting System.Security.Cryptography.Pkcs versions >= 10.0.0, <= 10.0.12 affecting System.Security.Cryptography.Pkcs versions >= 11.0.0-preview.1, <= 11.0.0-rc.1 CVE-2026-84008 with a CVSS score of 7.5 exists in System.Security.Cryptography.Pkcs, allowing unauthenticated quadratic CPU exhaustion via repeated reparsing of attacker-controlled X.509 data by the SignedCms.CheckSignature function, leading to denial-of-service attacks on.NET projects using affected package versions across Windows, Linux, and macOS platforms with all architectures. This flaw is attributed to an inefficient algorithmic complexity in the vulnerable component. The business impact of this vulnerability is significant due to potential downtime and resource consumption, emphasizing the need for prompt updates to remove this vulnerability. Affected.NET projects can be identified by referencing the impacted package versions listed in the advisory, which include specific version ranges for System.Security.Cryptography.Pkcs across multiple branches.[emaillocker id="1283"]

 

RECOMMENDATIONS:

  • We recommend you to update System.Security.Cryptography.Pkcs to version 10.0.13, 11.0.0-rc.2, 8.0.2, or 9.0.21 or later.

 

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-846f-f764-76mx

[/emaillocker]
crossmenu