Bulletin ID	MET-2026-003
Date (published)	2026-10-22T00:00:00.000Z
Date (last updated)	2026-10-22T00:00:00.000Z
Severity	Informational

Description

On October 13th, 2026, Microsoft published four denial-of-service vulnerabilities in the .NET cryptography libraries:

• CVE-2026-84008 in System.Security.Cryptography.Pkcs: SignedCms.CheckSignature can repeatedly reparse attacker-controlled X.509 data, causing quadratic CPU usage.
• CVE-2026-96958, CVE-2026-96959 and CVE-2026-96960 in System.Security.Cryptography.Xml and System.Private.Xml: verifying or decrypting attacker-controlled signed or encrypted XML (SignedXml, EncryptedXml and the canonicalization transforms) can consume unbounded CPU and memory.

The vulnerabilities are fixed in .NET runtime 10.0.13 and 9.0.21, and in version 10.0.13 of the System.Security.Cryptography.Pkcs and System.Security.Cryptography.Xml NuGet packages.

Affected Products/Services

Metaplay infrastructure and product are not affected by these vulnerabilities.

• MetaplaySDK does not call SignedCms, EnvelopedCms, SignedXml or EncryptedXml, and does not parse XML from any source. Apple in-app purchases are validated with Apple's server APIs and JWS-signed transactions, not by parsing PKCS #7 receipts on the game server.
• No library in the game server calls these APIs either. In the game server build, the only assembly that references System.Security.Cryptography.Xml is Microsoft.Build.Tasks.Core, a transitive dependency of the Microsoft.EntityFrameworkCore.Design and Microsoft.CodeAnalysis.Workspaces.MSBuild build tooling. The game server never runs MSBuild tasks. No assembly references System.Security.Cryptography.Pkcs.
• Within ASP.NET Core, these assemblies are used by Data Protection's XML key ring encryption and by XML configuration files. MetaplaySDK replaces ASP.NET Core Data Protection with its own provider, which encrypts with AES-GCM using keys stored in the game database and configures no XML encryption. MetaplaySDK does not load XML configuration files.

Impact

None.

Solution

As MetaplaySDK is not affected, no action is required.

The game server loads these assemblies from the ASP.NET Core shared framework in the .NET runtime, not from the NuGet packages, so the version that runs is decided by the runtime in the server image. The server image is based on mcr.microsoft.com/dotnet/aspnet:10.0, and an image built on a freshly pulled base image after October 13th, 2026 runs the patched .NET 10.0.13 runtime or later. As a general practice, rebuild and redeploy your game server regularly to pick up .NET runtime security fixes.

The fixed package versions will be included in the next MetaplaySDK release. To silence the NU1903 build warnings emitted by NuGet's security audit before that, override the transitive packages with the patched versions in the project file. The patch has been tested to apply to MetaplaySDK versions 37 and 38. In version 37, the existing System.Security.Cryptography.Xml reference is at version 9.0.18.

MetaplaySDK/Backend/Cloud/Metaplay.Cloud.csproj

-   <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" NoWarn="NU1510" />
+   <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.13" NoWarn="NU1510" />
+   <!-- Override the transitive System.Security.Cryptography.Pkcs (CVE-2026-84008) with the patched version. -->
+   <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" NoWarn="NU1510" />

CVE and CVSS Information

• CVE-2026-84008
• CVE-2026-96958
• CVE-2026-96959
• CVE-2026-96960

References

• GHSA-846f-f764-76mx
• GHSA-r955-8q5j-3h83
• GHSA-c399-9853-6jmj
• GHSA-7hqp-7c5m-4vq6
• .NET announcements

Contact Information

Security-related questions or concerns can be sent to security@metaplay.io.

Revision History

Date	Description
2026-10-22	Security Bulletin released