Inquiry regarding a vulnerability in the dependency package System.Security.Cryptography.Pkcs 8.0.0

GroupDocs.Conversion Product Family
1

We use GroupDocs.Conversion 26.9.0 in our .NET Framework 4.8.1 application.
The dependency package System.Security.Cryptography.Pkcs 8.0.0—which is used by GroupDocs.Conversion.Net462—has been flagged for the following vulnerabilities.
One of these is classified as having “High” severity.
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability · CVE-2026-84008 · GitHub Advisory Database · GitHub
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability · CVE-2026-70162 · GitHub Advisory Database · GitHub

This application does not directly reference or use the System.Security.Cryptography.Pkcs API.
It appears that this dependency is introduced via System.Security.Cryptography.Pkcs.

Could you please answer the following questions?
・Do these vulnerabilities also affect applications that use GroupDocs.Conversion on .NET Framework 4.8.1?
・Are there any plans to update System.Security.Cryptography.Pkcs 8.0.0 to a non-vulnerable version?
・What actions do you recommend taking?

2

Hi @KenichiYamamoto,

Thank you for the report and for linking the advisories.

We’ve already addressed this. The System.Security.Cryptography.Pkcs dependency has been updated to version 8.0.2, which patches both GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7 (we also bumped System.Formats.Asn1, which was affected by a related advisory). The change applies to all target frameworks, including .NET Framework 4.6.2+, so your 4.8.1 application will pick it up. The fix will be released at the end of this month with GroupDocs.Conversion 26.10.

Regarding exposure in the current version: GroupDocs.Conversion doesn’t use the specific code paths described in those advisories, so we’re not aware of a practical attack vector through our API. That said, vulnerability scanners flag the package version regardless of usage, and updating is the right call.

Until 26.10 is out, you can clear the warning on your side by adding a direct package reference to System.Security.Cryptography.Pkcs 8.0.2 in your project — a direct reference overrides the transitive 8.0.0 one.