.NET 6 end of life
.NET 6 reached end of support on 12 November 2024, three years after its release on 8 November 2021. Microsoft shipped its final servicing release, 6.0.36, and has published no security patches for the .NET 6 runtime since. Every vulnerability disclosed in .NET 6 after that date remains unpatched by Microsoft.
What now
Which vendors provide .NET 6 security patches now that support has ended?
.NET 8 Extended Support After November 10, 2026- End of life
- 12 November 2024
- Released
- Nov 2021
- Final release
- 6.0.36
- Successor
- .NET 10 (LTS, supported to 14 November 2028)
Date published by Microsoft .NET support policy. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 12 November 2024
- All security and servicing patches for the .NET 6 runtime, SDK, ASP.NET Core 6 and EF Core 6.
- Microsoft container base images for .NET 6 are no longer rebuilt, so the OS layer beneath your application stops receiving fixes as well.
- Microsoft technical support for .NET 6 issues, including under paid support agreements.
What actually breaks in the upgrade
6 to 10 crosses four majors
Estates still on 6 in 2026 are two years past the date and four major versions behind. The accumulated breaking-change surface is the reason they are still there: it is rarely one blocker, it is a dozen small ones across serialisation, authentication and hosting.
The container base image is the part teams miss
Even a team that has accepted runtime risk is often unaware that mcr.microsoft.com images for 6.0 stopped being rebuilt. The CVEs accumulating there are Debian and Alpine package CVEs, not .NET ones, and they show up in every image scan.
CVEs fixed in .NET since .NET 6 ended
OSSeva's CVE directory records 8 .NET vulnerabilities scored 7.0 or higher that Microsoft published after .NET 6 ended on 12 November 2024. 3 score 9.0 or higher. Microsoft's advisories list fixes for .NET 8, 9 and 10 and no .NET 6.0 build, because .NET 6 is out of support and Microsoft no longer states whether it is affected. Checking each one against the 6.0 code is the work an extended-support provider does.
High-severity .NET CVEs published after 12 November 2024, from the OSSeva CVE directory
| CVE | CVSS | Published | Issue | Fixed by Microsoft in |
|---|---|---|---|---|
| CVE-2026-62898 | 7.5 | 11 Aug 2026 | .NET: use after free in Microsoft QUIC discloses memory | 8.0.30; 9.0.19; 10.0.11 |
| CVE-2026-47304 | 9.8 | 14 Jul 2026 | .NET: EncryptedXml signature verification flaw allows security feature bypass | 8.0.29; 9.0.18; 10.0.10 |
| CVE-2026-47303 | 8.8 | 14 Jul 2026 | ASP.NET Core Negotiate authentication: improper parsing allows elevation of privilege | 8.0.29; 9.0.18; 10.0.10 |
| CVE-2026-47300 | 8.8 | 14 Jul 2026 | ASP.NET Core Negotiate authentication: incorrect validation with LDAP roles allows elevation of privilege | 8.0.29; 9.0.18; 10.0.10 |
| CVE-2026-50528 | 8.2 | 14 Jul 2026 | .NET SslStream: authorization checks can be bypassed on TLS connections | 8.0.29; 9.0.18; 10.0.10 |
| CVE-2026-45591 | 7.5 | 9 Jun 2026 | ASP.NET Core SignalR and Blazor Server: deeply nested MessagePack arrays cause denial of service | 8.0.28; 9.0.17; 10.0.9 |
| CVE-2026-40372 | 9.1 | 21 Apr 2026 | ASP.NET Core Data Protection: forged authentication cookies and payload decryption | 10.0.7 |
| CVE-2025-55315 | 9.9 | 14 Oct 2025 | ASP.NET Core Kestrel: HTTP request smuggling allows security feature bypass | 8.0.21; 9.0.10; 10.0.0-rc.2; updated Kestrel.Core 2.3 package |
The directory lists .NET CVEs with a CVSS score of 7.0 or higher, matched at NVD to the product, so it is a subset of every .NET advisory. CVSS is NVD's score where NVD has scored the record, otherwise the CNA's. Fixed-in versions are from Microsoft's advisories. Directory checked 22 October 2026.
Stay on .NET 6 with extended support
Microsoft's support policy lists no paid extension for .NET 6. OSSeva backports security fixes to .NET 6 today, as signed runtime builds for Windows and Linux delivered through your own repository manager, on the Patch, Assure and Operate tiers. It rebuilds container base images too, so the operating-system layer is current as well as the runtime.
The published Patch commitments apply: critical vulnerabilities (CVSS 9.0 or higher) patched within 48 hours, high-severity within 7 days, everything else in a quarterly batch. Extended support covers the time the migration to .NET 10 takes. It does not replace the migration.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to .NET 10 | Four majors of change. The right answer, and the one that keeps being deferred. | Months for a non-trivial estate | Engineering time | Do it. Extended support exists to protect the estate while this runs, not to replace it. |
| Extended support for .NET 6 | CVE backports to the 6.0 line plus rebuilt base images, delivered through your repository manager. | Days to onboard | Subscription per application or estate | The pragmatic answer for a regulated estate with a real migration plan and a real audit date. |
| Stay unpatched | Two years of unpatched runtime CVEs and an unrebuilt base image. | None | Zero now | Difficult to defend to an assessor in 2026. The image-layer CVEs alone will fail a scan gate. |
What OSSeva does for .NET 6
OSSeva patches this line
OSSeva backports CVE fixes to .NET 6 and rebuilds the container base images so the OS layer is current even though the runtime line is not. Delivered as signed packages and images through your own repository manager. We patch; we do not add features or change behaviour.
.NET extended supportWhat your auditor will say
Two years of unpatched runtime and image-layer CVEs is the clearest possible failure of requirement 6.3.3. This is usually the finding that starts the conversation.
CC7.1 expects vulnerabilities to be identified and remediated. An unsupported runtime with a growing CVE count and no remediation path is a control deficiency, not an accepted risk, unless the risk acceptance is formally documented and time-bound.
When did .NET 6 reach end of life?
.NET 6 reached end of support on 12 November 2024, three years after its 8 November 2021 release. The final servicing release was 6.0.36.
Is .NET 6.0 end of support the same as end of life?
Yes. Microsoft's support policy uses end of support, and .NET 6.0 reached it on 12 November 2024 with the final servicing release, 6.0.36. After that date Microsoft ships no security patches, bug fixes or technical support for .NET 6.
Has Microsoft fixed any .NET vulnerabilities for .NET 6 since 12 November 2024?
No .NET 6 build has shipped since 6.0.36. OSSeva's CVE directory lists 8 high-severity .NET CVEs published after that date, and Microsoft's advisories list fixes for .NET 8, 9 and 10 only. Third-party extended support is the only route to .NET 6 fixes.
Is .NET 6 still supported?
No. Microsoft has published no security or servicing patches for .NET 6 since 12 November 2024, and the official container base images are no longer rebuilt.
Is it safe to keep running .NET 6?
It runs, but it accumulates unpatched vulnerabilities in both the runtime and the container base image. For an internet-facing or regulated workload this is difficult to defend to an assessor without a third-party patch source.
Can I still get security patches for .NET 6?
Not from Microsoft. Third-party extended support providers including OSSeva backport CVE fixes to the 6.0 line and rebuild the base images.
What should I upgrade .NET 6 to?
.NET 10, the current LTS release, supported to 14 November 2028. Note that .NET 8 itself reaches end of support on 10 November 2026, so upgrading 6 to 8 now buys very little time.
Why do my .NET 6 image scans show so many CVEs?
Most of them are not .NET CVEs. Microsoft stopped rebuilding the .NET 6 container base images, so the Debian or Alpine packages underneath your application have not received OS-level fixes since the date. Rebuilding the image on a current base resolves the majority.
Get a quote
Still running .NET 6?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?