Microsoft .NET Framework full changelog

This release includes a fix for CVE-2026-40372
After the Patch Tuesday .NET 10.0.6 release, some customers reported that decryption was failing in their applications. This behavior was reported in aspnetcore issue #66335.
While investigating those reports, we determined that the regression also exposed a vulnerability. In versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package, the managed authenticated encryptor could compute its HMAC validation tag over the wrong bytes of the payload and then discard the computed hash, which could result in elevation of privilege.

.NET 10.0.4 release carries security fixes:
CVE-2026-26127 | .NET Denial of Service Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input.
CVE-2026-26130 | .NET Denial of Service Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.
CVE-2026-26131 | NET Elevation of Privilege Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privilege vulnerability exists in .NET due to improper authorization. Incorrect packaging permissions could allow an attacker to gain elevated privileges.

What’s new in .NET 5:
NET 5.0 is the next major release of .NET Core following 3.1. We named this new release .NET 5.0 instead of .NET Core 4.0 for two reasons:
We skipped version numbers 4.x to avoid confusion with .NET Framework 4.x.
We dropped “Core” from the name to emphasize that this is the main implementation of .NET going forward. .NET 5.0 supports more types of apps and more platforms than .NET Core or .NET Framework.
ASP.NET Core 5.0 is based on .NET 5.0 but retains the name “Core” to avoid confusing it with ASP.NET MVC 5. Likewise, Entity Framework Core 5.0 retains the name “Core” to avoid confusing it with Entity Framework 5 and 6.
.NET 5.0 includes the following improvements and new features compared to .NET Core 3.1:
C# updates
F# updates
Visual Basic updates
System.Text.Json new features
Single file apps
App trimming
Windows ARM64 and ARM64 intrinsics
Tooling support for dump debugging
The runtime libraries are 80% annotated for nullable reference types