7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21218

CVE-2026-21218: .NET Spoofing Vulnerability

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21218

CVE-2026-21218:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
System.Security.Cryptography.Cose	nuget	>= 8.0.0, <= 8.0.23	8.0.24
System.Security.Cryptography.Cose	nuget	>= 9.0.0, <= 9.0.12	9.0.13
System.Security.Cryptography.Cose	nuget	>= 10.0.0, <= 10.0.2	10.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the decoding of COSE messages within the System.Security.Cryptography.Cose library. The analysis of the patch commit 9e1f70e56f7d49f64c61b2a24984e4a0193a0229 reveals two main issues that were fixed.

First, the DecodeBucket method, which is responsible for parsing COSE header parameters, was not correctly handling exceptions. An invalid header value could cause the underlying CoseHeaderMap.Add method to throw an ArgumentException. The decoding methods were expected to throw a CryptographicException on failure. This discrepancy could lead to a security bypass if the calling application only catches CryptographicException to handle parsing errors, thereby incorrectly treating a malicious message as valid. The patch rectifies this by wrapping the ArgumentException in a CryptographicException.

Second, the MissingCriticalHeaders method did not validate if the "crit" header list was empty. An empty list is invalid according to the COSE specification. The unpatched code would accept it, potentially leading to a bypass of critical header processing. The patch adds a check to throw a CryptographicException if the list is empty.

The public methods DecodeSign1 and DecodeMultiSign are the primary entry points for decoding signed COSE messages and are therefore the vulnerable functions that would appear in a runtime profile during exploitation. An attacker would craft a COSE message with either an invalid header value designed to trigger an ArgumentException or an empty critical header list to exploit this vulnerability. The fix ensures that both of these conditions are properly handled and result in a CryptographicException, preventing the bypass.

Vulnerable functions

System.Security.Cryptography.Cose.CoseMessage.DecodeSign1

src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseMessage.cs

This function is vulnerable because it processes externally supplied COSE messages. Prior to the patch, it would either fail to throw an exception for a malformed critical header list (empty list) or throw an unexpected `ArgumentException` for certain invalid header values. This could cause applications to misinterpret a malicious message as valid if they only catch `CryptographicException`, leading to a security feature bypass.

System.Security.Cryptography.Cose.CoseMessage.DecodeMultiSign

src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseMessage.cs

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.