dotnet / dotnet/wcf

Error NU1901: Package 'System.Security.Cryptography.Xml' 10.0.0 has a known low severity vulnerability

Open
#5,935 5 comments 28 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
1.8k
Forks
576
Avg merge
6d 9h
Merged PRs (30d)
2

Description

**Describe the bug**
We updated the System.ServiceModel.Http to v10.0.652802 NuGet package in our VS 26 solution on .NET 10 and during the build we got this warning from the transient package:

`Warning NU1901: Package 'System.Security.Cryptography.Xml' 10.0.0 has a known low severity vulnerability`

**To Reproduce**
Steps to reproduce the behavior:
1. Update in VS the NuGet System.ServiceModel.Http to v10.0.652802 and build the project.
2. In VS we called `dotnet nuget why src// System.Security.Cryptography.Xml` and got the following output
Project '' has the following dependency graph(s) for 'System.Security.Cryptography.Xml':
[net10.0]
└── System.ServiceModel.Http (v10.0.652802)
└── System.ServiceModel.Primitives (v10.0.652802)
└── System.Security.Cryptography.Xml (v10.0.0) // Should be v10.0.6

**Expected behavior**
We expected that the transient package System.Security.Cryptography.Xml v10.0.6 comes automatically with the update of System.ServiceModel.Http v10.0.652802
We would like not to add the package System.Security.Cryptography.Xml v10.0.6 explicit in our project file and use only the correct transient package of System.Security.Cryptography.Xml.

**Screenshots**

Image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.