Product: XPacs
Date: 24 October 2026
Scope: System.Security.Cryptography.Pkcs 10.0.0 and SixLabors.ImageSharp 3.1.11, as reported by NuGet audit
Target framework: net10.0
Both packages are transitive. Neither is referenced directly by an XPacs project. The installed .NET runtime is 10.0.13, which contains the Pkcs fix, but the application graph still resolves package 10.0.0 and ships that assembly.
The Pkcs findings are denial-of-service bugs in CMS/PKCS#7 APIs. XPacs does not call those APIs. The only callers inside the process are SQL Server enclave attestation and S/MIME handling. The current connection string and the Serilog email sink do not use either feature. These two advisories do not change how the system behaves today.
ImageSharp is on a real code path, but only one of the five advisories is reachable. An authenticated user who is allowed to upload files can submit a tiny malformed BigTIFF and keep one request thread busy. The three high-severity ImageSharp issues require TIFF encoding or HistogramEqualization. XPacs does not do either. DICOM receive, routing, thumbnails, and JPEG export do not pass through the vulnerable ImageSharp decoders or encoders.
| Package | Resolved version | Source | Practical effect on XPacs |
|---|---|---|---|
System.Security.Cryptography.Pkcs |
10.0.0 | Microsoft.Data.SqlClient 7.1.1, MimeKit 4.16.0 |
Vulnerable assembly is deployed. The vulnerable methods are not called. |
SixLabors.ImageSharp |
3.1.11 | fo-dicom.Imaging.ImageSharp 5.2.6 |
Authenticated picture upload can stall one thread via a malformed BigTIFF. DICOM imaging is unaffected by these advisories. |
dotnet list package --include-transitive --vulnerable on XPacs.Data reports:
SixLabors.ImageSharp 3.1.11System.Security.Cryptography.Pkcs 10.0.0dotnet nuget why shows the dependency edges:
System.Security.Cryptography.Pkcs 10.0.0
├── Microsoft.Data.SqlClient 7.1.1
│ └── Microsoft.EntityFrameworkCore.SqlServer 10.0.13
└── MimeKit 4.16.0
└── MailKit 4.16.0