Error NU1901: Package 'System.Security.Cryptography.Xml' 10.0.0 has a known low severity vulnerability
- Dominant language
- C#
- Stars
- 1.8k
- Forks
- 576
- Avg merge
- 6d 9h
- Merged PRs (30d)
- 2
Description
**Describe the bug**
We updated the System.ServiceModel.Http to v10.0.652802 NuGet package in our VS 26 solution on .NET 10 and during the build we got this warning from the transient package:
`Warning NU1901: Package 'System.Security.Cryptography.Xml' 10.0.0 has a known low severity vulnerability`
**To Reproduce**
Steps to reproduce the behavior:
1. Update in VS the NuGet System.ServiceModel.Http to v10.0.652802 and build the project.
2. In VS we called `dotnet nuget why src// System.Security.Cryptography.Xml` and got the following output
Project '' has the following dependency graph(s) for 'System.Security.Cryptography.Xml':
[net10.0]
└── System.ServiceModel.Http (v10.0.652802)
└── System.ServiceModel.Primitives (v10.0.652802)
└── System.Security.Cryptography.Xml (v10.0.0) // Should be v10.0.6
**Expected behavior**
We expected that the transient package System.Security.Cryptography.Xml v10.0.6 comes automatically with the update of System.ServiceModel.Http v10.0.652802
We would like not to add the package System.Security.Cryptography.Xml v10.0.6 explicit in our project file and use only the correct transient package of System.Security.Cryptography.Xml.
**Screenshots**
Contributor guide
Assessment
This issue has not been assessed yet.