HeroDevs
Visit NES for .NET Home Page

.NET 6.0.x Release Notes

Comprehensive release notes and changelog for .NET 6.0.x, including security patches, bug fixes, and feature updates across all supported versions.

44 Patched Vulnerabilities
VEX Statements

.NET 6.0.43 - July 16, 2026

  • Version: 6.0.43
  • Security fixes in the .NET runtime shared framework — apply to all applications running on the runtime (Microsoft.NETCore.App):
    • CVE-2026-50651 A denial-of-service (out-of-memory) in the HTTP/2 client (System.Net.Http) where a malicious server can flood a connection with SETTINGS/PING frames faster than the client acknowledges them, growing an unbounded internal write queue; the client now caps the number of outstanding fire-and-forget frames and aborts the connection when the limit is exceeded.
    • CVE-2026-50659 An SMTP smuggling / spoofing issue in System.Net.Mail where a deferred trailing carriage return could split message content across writes; dot-stuffing is now applied correctly across buffer boundaries.
    • CVE-2026-50528 A security-feature-bypass in System.Net.Security NegotiateStream where Extended Protection support was not enforced on Unix; the support check now fails closed.
    • CVE-2026-57108 A denial-of-service in X.509 certificate name parsing (System.Security.Cryptography.X509Certificates, GetX509NameInfo) caused by ASN.1 type confusion in UPN otherName subject alternative names; the parser now validates the ASN.1 type.
  • Security fixes in the opt-in System.Security.Cryptography.Xml package — apply only to applications that reference it:
    • CVE-2026-47302 A denial-of-service in XML encryption processing where an unbounded transform chain could be abused; the transform-chain length is now capped.
    • CVE-2026-47304 A security-feature-bypass where SignedXml accepted truncated HMAC signatures; truncated HMAC signatures are now rejected by default.
    • CVE-2026-50525 A denial-of-service in XML decryption where the number of decrypted EncryptedData elements was unbounded; a configurable cap is now enforced.
    • CVE-2026-50527 A denial-of-service where a + character in a cryptographic algorithm type name could be abused; such names are now rejected.
    • CVE-2026-50648 A denial-of-service caused by transform state retained across an XML transform chain; transform state is now released across the chain.
  • Security fixes in the opt-in Microsoft.AspNetCore.Authentication.Negotiate package — apply only to applications that reference it:
    • CVE-2026-47300 An elevation-of-privilege in the Negotiate LDAP adapter where a principal from a foreign realm could be resolved against a same-named local account; claims retrieval now verifies the principal's realm against the configured LDAP domain (and escapes LDAP filter values).
    • CVE-2026-47303 An LDAP identifier-confusion issue (CN vs. sAMAccountName) in the Negotiate LDAP adapter; groups are now resolved by distinguished name, with nested-group cycle detection to prevent unbounded recursion.
  • Security fixes in Windows Presentation Foundation (WPF) — apply to WPF desktop applications:
    • CVE-2026-50646 A remote code execution vulnerability in WPF XAML parsing.
    • CVE-2026-50649 A remote code execution vulnerability in WPF XAML parsing.
    • CVE-2026-50650 An elevation-of-privilege vulnerability in WPF XAML parsing.

.NET 6.0.42 - June 27, 2026

  • Version: 6.0.42
  • Security fixes in the .NET SDK's bundled build tooling — apply to the dotnet CLI and build/restore/pack operations (all SDK users); the runtime that applications execute on is unaffected:
    • GHSA-g4vj-cjjj-v7hg A defense-in-depth fix in the NuGet client bundled with the SDK that validates a downloaded package's identity (ID and version) against the requested package, preventing a compromised or misconfigured feed from serving a different package than requested.
    • CVE-2024-43485 The System.Text.Json assembly bundled with the SDK was updated 6.0.0 → 6.0.11, addressing a deserialization denial-of-service. (The in-box System.Text.Json in the runtime shared framework — which applications use at runtime — was already patched in earlier releases and is unchanged in 6.0.42.)
  • Dependency security updates in opt-in ASP.NET Core add-on packages — apply only to applications that reference the listed package:
    • Microsoft.AspNetCore.SignalR.Protocols.MessagePack — bundled MessagePack updated 2.1.90 → 2.5.301:
    • Microsoft.Extensions.Caching.SqlServer and the dotnet-sql-cache tool — bundled Microsoft.Data.SqlClient updated 2.1.7 → 5.2.2 (which pulls patched Azure.Identity 1.10.2 → 1.11.4):
      • CVE-2024-35255 A vulnerability in the Azure Identity library for .NET where improper handling of local resources can allow an authenticated attacker to elevate privileges locally.
      • CVE-2024-29992 An information disclosure vulnerability in the Azure Identity library for .NET that can expose sensitive information to an attacker.
      • Note: Microsoft.Data.SqlClient 5.x defaults connection encryption to Encrypt=true; connection strings targeting a server without a trusted TLS certificate may need Encrypt=False or TrustServerCertificate=True.
    • Microsoft.AspNetCore.SignalR.StackExchangeRedis and Microsoft.AspNetCore.DataProtection.StackExchangeRedis — bundled StackExchange.Redis updated 2.2.4 → 2.7.27 (end-of-life dependency moved to a supported, security-maintained version).

.NET 6.0.41 - June 10, 2026

  • Version: 6.0.41
  • Security fixes for the following CVEs:
    • CVE-2026-32177 A heap-based buffer overflow vulnerability in .NET can allow an unauthorized attacker to elevate privileges locally.
    • CVE-2026-35433 A vulnerability in .NET can allow an unauthorized attacker to elevate privileges locally.
    • CVE-2026-45490 An improper authorization vulnerability in .NET can allow an authorized attacker to elevate privileges locally.
    • CVE-2026-45591 An uncontrolled resource consumption vulnerability in ASP.NET Core can allow an unauthorized attacker to deny service over a network.

.NET 6.0.40 - April 14, 2026

  • Version: 6.0.40
  • Security fixes for the following CVEs:
    • CVE-2026-32178 A vulnerability in System.Net.Mail where specially crafted email address data can be used to perform a spoofing attack over the network
    • CVE-2026-26171 A vulnerability in System.Security.Cryptography.Xml where EncryptedXml processing can trigger uncontrolled resource consumption, allowing an attacker to deny service over the network

.NET 6.0.39 - October 17, 2025

  • Version: 6.0.39
  • Security fixes for the following CVEs:
    • CVE-2025-55315 A vulnerability that involves inconsistent interpretation of HTTP requests in ASP.NET Core and Microsoft.AspNetCore.Server.Kestrel.Core, enabling a sophisticated attack known as HTTP Request Smuggling

.NET 6.0.38 - June 4, 2025

  • Version: 6.0.38
  • Security fixes for the following CVEs:
    • CVE-2025-7326 A vulnerability exists in applications using ASP.NET and the Microsoft.AspNetCore.Identity Nuget Package when calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.
    • CVE-2025-24070 A vulnerability exists in applications using ASP.NET and the Microsoft.AspNetCore.Identity Nuget Package when calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.
    • CVE-2025-21176 A vulnerability exists in DiaSymReader.dll due to buffer over-read. Insufficient input validation in Visual Studio allows remote code execution via crafted files. An attacker could exploit this vulnerability by loading a maliciously crafted file in Visual Studio.
    • CVE-2025-21173 A vulnerability exists in the .NET SDK as a result of insecure temporary file usage on Linux that allows local system privilege escalation by attackers.
    • CVE-2025-21172 A vulnerability exists in msdia140.dll due to integer overflow and heap-based overflow. Exploitation of this vulnerability requires that an attacker convince a user to open a maliciously crafted package file in Visual Studio.
    • CVE-2024-38229 A vulnerability exists in ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution.
    • CVE-2024-35264 A vulnerability exists in ASP.NET Core where Data Corruption in Kestrel HTTP/3 can result in remote code execution.