HeroDevs
Visit NES for .NET Home Page

.NET 6.0.x Release Notes

Comprehensive release notes and changelog for .NET 6.0.x, including security patches, bug fixes, and feature updates across all supported versions.

59 Patched Vulnerabilities
VEX Statements

.NET 6.0.45 - August 18, 2026

  • Version: 6.0.45
  • Security fixes in the .NET runtime shared framework — apply to all applications running on the runtime (Microsoft.NETCore.App):
    • CVE-2025-30399 A remote-code-execution issue in the .NET native host where, for an application carrying no .deps.json, the runtime library path was composed from an empty application directory in component-hosting mode, leaving a relative path that the platform loader resolved through its ambient search order including the current working directory; the fallback no longer runs in component-hosting mode, and every host library load now requires a rooted path.
    • CVE-2025-55248 An information-disclosure issue in System.Net.Mail where an asynchronous send with EnableSsl set continued over an unencrypted connection when the server rejected EHLO, because STARTTLS is advertised only in the EHLO response; the asynchronous path now fails closed, matching the synchronous one.
  • Security fixes in Kestrel's HTTP/3 support — apply only to applications that have enabled HTTP/3 on a Kestrel listener (Microsoft.AspNetCore.App):
    • CVE-2025-26682 A denial-of-service in HTTP/3 control-stream handling where the full declared length of a frame was buffered before the frame was processed, so a peer could hold a large and growing allocation with very little traffic; an oversized control-stream frame is now rejected as soon as its declared length can be read.
  • Security fixes in the .NET SDK's bundled build tooling — apply to the dotnet CLI and build operations (all SDK users); the runtime that applications execute on is unaffected. The SDK now bundles Microsoft.Build.* 17.3.4.1:
    • CVE-2025-26646 A spoofing issue in the MSBuild DownloadFile task where the output filename was taken from the response's Content-Disposition header rather than from the requested address, letting the responding server rename the download and so overwrite an existing file in the destination folder; the name is now derived from the request.
    • CVE-2025-55247 A denial-of-service on Linux where MSBuild created its temporary directory at a path derived from the user name, so any other local user could predict that path and create it first; the directory is now created with an unpredictable name and owner-only permissions.

.NET 6.0.44 - August 13, 2026

  • Version: 6.0.44
  • Security fixes in the .NET runtime shared framework — apply to all applications running on the runtime (Microsoft.NETCore.App):
    • CVE-2026-62901 A denial-of-service in WebSocket permessage-deflate decompression (System.Net.WebSockets) where a message terminated with a BFINAL final block left compressed bytes unconsumed, so the inflater made no forward progress and the receive loop never completed; such messages are now rejected.
    • CVE-2026-62909 An information-disclosure and elevation-of-privilege issue on Linux where a failure to generate the diagnostics IPC socket name left the socket bound to the abstract namespace, which carries no filesystem permissions and is reachable by any process in the same network namespace; name-generation failure is now fatal instead.
    • CVE-2026-62899 A request-smuggling issue in the managed HttpListener (non-Windows only) where a Content-Length above long.MaxValue was silently treated as 0 rather than rejected, desynchronising the request body boundary from what a front-end proxy computed; the header is now parsed strictly and invalid values fail the request.
  • Security fixes in Windows Presentation Foundation (WPF) — apply to WPF desktop applications on Windows (Microsoft.WindowsDesktop.App):
    • CVE-2026-62871 An elevation-of-privilege issue in the TrueType font subsetter where character-map and embedded-bitmap table offsets and counts were used without bounds validation, allowing a crafted font to drive a heap out-of-bounds write; the subsetter now validates those tables before use.
    • CVE-2026-62886 An elevation-of-privilege issue in glyph-run geometry generation (CGlyphRunGeometrySink) where an integer overflow in a size calculation produced an undersized allocation and a subsequent heap out-of-bounds write; the arithmetic is now overflow-checked.
    • CVE-2026-62897 A remote-code-execution issue in glyph-run geometry generation (CGlyphRunGeometrySink) arising from the same class of unchecked integer arithmetic on a separate path; that path is now overflow-checked as well.
    • CVE-2026-70354 A remote-code-execution issue in the pixel-shader bytecode translator where a NOP instruction was not handled in the pass that sizes the instruction buffer, so a shader with a parameter-style token after a NOP was counted short and the decode pass wrote past the buffer; such shaders are now rejected.
    • CVE-2026-62902 An information-disclosure issue in XPS document handling where resource loading was not confined to the containing package, so a crafted document could cause outbound requests to attacker-chosen locations (server-side request forgery) and could send default credentials with them; resource loading is now scoped to its own package and default credentials are no longer supplied.

.NET 6.0.43 - July 16, 2026

  • Version: 6.0.43
  • Security fixes in the .NET runtime shared framework — apply to all applications running on the runtime (Microsoft.NETCore.App):
    • CVE-2026-50651 A denial-of-service (out-of-memory) in the HTTP/2 client (System.Net.Http) where a malicious server can flood a connection with SETTINGS/PING frames faster than the client acknowledges them, growing an unbounded internal write queue; the client now caps the number of outstanding fire-and-forget frames and aborts the connection when the limit is exceeded.
    • CVE-2026-50659 An SMTP smuggling / spoofing issue in System.Net.Mail where a deferred trailing carriage return could split message content across writes; dot-stuffing is now applied correctly across buffer boundaries.
    • CVE-2026-50528 A security-feature-bypass in System.Net.Security NegotiateStream where Extended Protection support was not enforced on Unix; the support check now fails closed.
    • CVE-2026-57108 A denial-of-service in X.509 certificate name parsing (System.Security.Cryptography.X509Certificates, GetX509NameInfo) caused by ASN.1 type confusion in UPN otherName subject alternative names; the parser now validates the ASN.1 type.
  • Security fixes in the opt-in System.Security.Cryptography.Xml package — apply only to applications that reference it:
    • CVE-2026-47302 A denial-of-service in XML encryption processing where an unbounded transform chain could be abused; the transform-chain length is now capped.
    • CVE-2026-47304 A security-feature-bypass where SignedXml accepted truncated HMAC signatures; truncated HMAC signatures are now rejected by default.
    • CVE-2026-50525 A denial-of-service in XML decryption where the number of decrypted EncryptedData elements was unbounded; a configurable cap is now enforced.
    • CVE-2026-50527 A denial-of-service where a + character in a cryptographic algorithm type name could be abused; such names are now rejected.
    • CVE-2026-50648 A denial-of-service caused by transform state retained across an XML transform chain; transform state is now released across the chain.
  • Security fixes in the opt-in Microsoft.AspNetCore.Authentication.Negotiate package — apply only to applications that reference it:
    • CVE-2026-47300 An elevation-of-privilege in the Negotiate LDAP adapter where a principal from a foreign realm could be resolved against a same-named local account; claims retrieval now verifies the principal's realm against the configured LDAP domain (and escapes LDAP filter values).
    • CVE-2026-47303 An LDAP identifier-confusion issue (CN vs. sAMAccountName) in the Negotiate LDAP adapter; groups are now resolved by distinguished name, with nested-group cycle detection to prevent unbounded recursion.
  • Security fixes in Windows Presentation Foundation (WPF) — apply to WPF desktop applications:
    • CVE-2026-50646 A remote code execution vulnerability in WPF XAML parsing.
    • CVE-2026-50649 A remote code execution vulnerability in WPF XAML parsing.
    • CVE-2026-50650 An elevation-of-privilege vulnerability in WPF XAML parsing.

.NET 6.0.42 - June 27, 2026

  • Version: 6.0.42
  • Security fixes in the .NET SDK's bundled build tooling — apply to the dotnet CLI and build/restore/pack operations (all SDK users); the runtime that applications execute on is unaffected:
    • GHSA-g4vj-cjjj-v7hg A defense-in-depth fix in the NuGet client bundled with the SDK that validates a downloaded package's identity (ID and version) against the requested package, preventing a compromised or misconfigured feed from serving a different package than requested.
    • CVE-2024-43485 The System.Text.Json assembly bundled with the SDK was updated 6.0.0 → 6.0.11, addressing a deserialization denial-of-service. (The in-box System.Text.Json in the runtime shared framework — which applications use at runtime — was already patched in earlier releases and is unchanged in 6.0.42.)
  • Dependency security updates in opt-in ASP.NET Core add-on packages — apply only to applications that reference the listed package:
    • Microsoft.AspNetCore.SignalR.Protocols.MessagePack — bundled MessagePack updated 2.1.90 → 2.5.301:
    • Microsoft.Extensions.Caching.SqlServer and the dotnet-sql-cache tool — bundled Microsoft.Data.SqlClient updated 2.1.7 → 5.2.2 (which pulls patched Azure.Identity 1.10.2 → 1.11.4):
      • CVE-2024-35255 A vulnerability in the Azure Identity library for .NET where improper handling of local resources can allow an authenticated attacker to elevate privileges locally.
      • CVE-2024-29992 An information disclosure vulnerability in the Azure Identity library for .NET that can expose sensitive information to an attacker.
      • Note: Microsoft.Data.SqlClient 5.x defaults connection encryption to Encrypt=true; connection strings targeting a server without a trusted TLS certificate may need Encrypt=False or TrustServerCertificate=True.
    • Microsoft.AspNetCore.SignalR.StackExchangeRedis and Microsoft.AspNetCore.DataProtection.StackExchangeRedis — bundled StackExchange.Redis updated 2.2.4 → 2.7.27 (end-of-life dependency moved to a supported, security-maintained version).

.NET 6.0.41 - June 10, 2026

  • Version: 6.0.41
  • Security fixes for the following CVEs:
    • CVE-2026-32177 A heap-based buffer overflow vulnerability in .NET can allow an unauthorized attacker to elevate privileges locally.
    • CVE-2026-35433 A vulnerability in .NET can allow an unauthorized attacker to elevate privileges locally.
    • CVE-2026-45490 An improper authorization vulnerability in .NET can allow an authorized attacker to elevate privileges locally.
    • CVE-2026-45591 An uncontrolled resource consumption vulnerability in ASP.NET Core can allow an unauthorized attacker to deny service over a network.

.NET 6.0.40 - April 14, 2026

  • Version: 6.0.40
  • Security fixes for the following CVEs:
    • CVE-2026-32178 A vulnerability in System.Net.Mail where specially crafted email address data can be used to perform a spoofing attack over the network
    • CVE-2026-26171 A vulnerability in System.Security.Cryptography.Xml where EncryptedXml processing can trigger uncontrolled resource consumption, allowing an attacker to deny service over the network
    • CVE-2026-32203 A vulnerability in System.Security.Cryptography.Xml where a buffer overflow in EncryptedXml processing can be triggered by specially crafted input, allowing an attacker to deny service over the network
    • CVE-2026-33116 A vulnerability in System.Security.Cryptography.Xml where EncryptedXml processing can be driven into an infinite loop, allowing an attacker to deny service over the network

.NET 6.0.39 - October 17, 2025

  • Version: 6.0.39
  • Security fixes for the following CVEs:
    • CVE-2025-55315 A vulnerability that involves inconsistent interpretation of HTTP requests in ASP.NET Core and Microsoft.AspNetCore.Server.Kestrel.Core, enabling a sophisticated attack known as HTTP Request Smuggling

.NET 6.0.38 - June 4, 2025

  • Version: 6.0.38
  • Security fixes for the following CVEs:
    • CVE-2025-7326 A vulnerability exists in applications using ASP.NET and the Microsoft.AspNetCore.Identity Nuget Package when calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.
    • CVE-2025-24070 A vulnerability exists in applications using ASP.NET and the Microsoft.AspNetCore.Identity Nuget Package when calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.
    • CVE-2025-21176 A vulnerability exists in DiaSymReader.dll due to buffer over-read. Insufficient input validation in Visual Studio allows remote code execution via crafted files. An attacker could exploit this vulnerability by loading a maliciously crafted file in Visual Studio.
    • CVE-2025-21173 A vulnerability exists in the .NET SDK as a result of insecure temporary file usage on Linux that allows local system privilege escalation by attackers.
    • CVE-2025-21172 A vulnerability exists in msdia140.dll due to integer overflow and heap-based overflow. Exploitation of this vulnerability requires that an attacker convince a user to open a maliciously crafted package file in Visual Studio.
    • CVE-2024-38229 A vulnerability exists in ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution.
    • CVE-2024-35264 A vulnerability exists in ASP.NET Core where Data Corruption in Kestrel HTTP/3 can result in remote code execution.