CVE-2026-33116: Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

April 14, 2026 (updated April 17, 2026)

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack.

References

github.com/advisories/GHSA-37gx-xxp4-5rgx
github.com/dotnet/announcements/issues/392
github.com/dotnet/runtime/security/advisories/GHSA-37gx-xxp4-5rgx
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116
nvd.nist.gov/vuln/detail/CVE-2026-33116

Code Behaviors & Features

Detect and mitigate CVE-2026-33116 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →