.NET 6 end of life
.NET 6 reached end of support on 12 November 2024, three years after its release on 8 November 2021. Microsoft shipped its final servicing release, 6.0.36, and has published no security patches for the .NET 6 runtime since. Every vulnerability disclosed in .NET 6 after that date remains unpatched by Microsoft.
- End of life
- 12 November 2024
- Released
- Nov 2021
- Final release
- 6.0.36
- Successor
- .NET 10 (LTS, supported to 14 November 2028)
Date published by Microsoft .NET support policy. We do not publish a lifecycle date we cannot source.
What actually stops on 12 November 2024
- All security and servicing patches for the .NET 6 runtime, SDK, ASP.NET Core 6 and EF Core 6.
- Microsoft container base images for .NET 6 are no longer rebuilt, so the OS layer beneath your application stops receiving fixes as well.
- Microsoft technical support for .NET 6 issues, including under paid support agreements.
What actually breaks in the upgrade
6 to 10 crosses four majors
Estates still on 6 in 2026 are two years past the date and four major versions behind. The accumulated breaking-change surface is the reason they are still there: it is rarely one blocker, it is a dozen small ones across serialisation, authentication and hosting.
The container base image is the part teams miss
Even a team that has accepted runtime risk is often unaware that mcr.microsoft.com images for 6.0 stopped being rebuilt. The CVEs accumulating there are Debian and Alpine package CVEs, not .NET ones, and they show up in every image scan.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to .NET 10 | Four majors of change. The right answer, and the one that keeps being deferred. | Months for a non-trivial estate | Engineering time | Do it. Extended support exists to protect the estate while this runs, not to replace it. |
| Extended support for .NET 6 | CVE backports to the 6.0 line plus rebuilt base images, delivered through your repository manager. | Days to onboard | Subscription per application or estate | The pragmatic answer for a regulated estate with a real migration plan and a real audit date. |
| Stay unpatched | Two years of unpatched runtime CVEs and an unrebuilt base image. | None | Zero now | Difficult to defend to an assessor in 2026. The image-layer CVEs alone will fail a scan gate. |
What OSSeva does for .NET 6
OSSeva patches this line
OSSeva backports CVE fixes to .NET 6 and rebuilds the container base images so the OS layer is current even though the runtime line is not. Delivered as signed packages and images through your own repository manager. We patch; we do not add features or change behaviour.
.NET extended supportWhat your auditor will say
Two years of unpatched runtime and image-layer CVEs is the clearest possible failure of requirement 6.3.3. This is usually the finding that starts the conversation.
CC7.1 expects vulnerabilities to be identified and remediated. An unsupported runtime with a growing CVE count and no remediation path is a control deficiency, not an accepted risk, unless the risk acceptance is formally documented and time-bound.
.NET 6: common questions
When did .NET 6 reach end of life?
.NET 6 reached end of support on 12 November 2024, three years after its 8 November 2021 release. The final servicing release was 6.0.36.
Is .NET 6 still supported?
No. Microsoft has published no security or servicing patches for .NET 6 since 12 November 2024, and the official container base images are no longer rebuilt.
Is it safe to keep running .NET 6?
It runs, but it accumulates unpatched vulnerabilities in both the runtime and the container base image. For an internet-facing or regulated workload this is difficult to defend to an assessor without a third-party patch source.
Can I still get security patches for .NET 6?
Not from Microsoft. Third-party extended support providers including OSSeva backport CVE fixes to the 6.0 line and rebuild the base images.
What should I upgrade .NET 6 to?
.NET 10, the current LTS release, supported to 14 November 2028. Note that .NET 8 itself reaches end of support on 10 November 2026, so upgrading 6 to 8 now buys very little time.
Why do my .NET 6 image scans show so many CVEs?
Most of them are not .NET CVEs. Microsoft stopped rebuilding the .NET 6 container base images, so the Debian or Alpine packages underneath your application have not received OS-level fixes since the date. Rebuilding the image on a current base resolves the majority.
Still running .NET 6?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.