OSSEVA FOR .NET
Microsoft support for .NET 8 and 9 ends 10 November 2026. Your .NET support does not have to.
OSSeva provides .NET support for .NET 6, 7, 8, 9 and 10, including patched builds for .NET 6 and 7 after Microsoft stopped fixing them, for .NET 8 and 9 once Microsoft support ends on 10 November 2026, and for .NET 10 once its support ends on 14 November 2028. Drop-in CVE patches cover the short-term support (STS) versions Microsoft has moved past, without forcing a runtime upgrade on Microsoft's schedule.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched .NET after end of life? .NET 8 Extended Support After November 10, 2026.
Last reviewed
Trusted globally by enterprises
Why now
.NET 8 and .NET 9 end on the same day: 10 November 2026
.NET 8 is a long-term support release and .NET 9 a standard-term one, but Microsoft gave .NET 9 a 24-month window, so both leave support on 10 November 2026. .NET 7 got 18 months and ended on 14 May 2024. OSSeva covers LTS and STS versions past Microsoft's dates.
.NET 6 LTS ended in November 2024, and .NET 8 and 9 follow on 10 November 2026
.NET 6 was an LTS release but reached EOL in November 2024. Enterprise applications that depend on .NET 6 APIs, including Azure Functions and ASP.NET Core applications, are now running without upstream CVE patches.
NuGet supply chain and CLR deserialization CVEs compound the risk
Beyond runtime CVEs, .NET applications face NuGet dependency supply chain risk and CLR-level deserialization vulnerabilities. OSSeva monitors both the runtime and common enterprise NuGet packages for the covered .NET versions.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| .NET 6.0 (LTS)(Community EOL Nov 2024) | EOL | Clean |
| .NET 7.0 (STS)(Community EOL May 2024) | EOL | Clean |
| .NET 8.0 (LTS)(Microsoft support ends 10 Nov 2026) | Current | Clean |
| .NET 9.0 (STS)(Microsoft support ends 10 Nov 2026) | Current | Clean |
| .NET 10.0 (LTS)(Microsoft support ends 14 Nov 2028) | Current | Clean |
Running a .NET version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for .NET 6 and 7 today, .NET 8 and 9 after 10 November 2026, and .NET 10 after 14 November 2028.
- Quarterly CVE patches for .NET 6.x and 7.x, and for 8.x, 9.x and 10.x after Microsoft EOL
- ASP.NET Core and CLR CVE coverage
- Windows installers; Linux Docker / apt / yum / binary delivery
- Signed artifacts (GPG + Sigstore)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus NuGet scanning, compliance docs, and migration planning.
- Everything in Patch
- NuGet dependency vulnerability scanning
- ASP.NET Core TLS and authentication configuration review
- SOC 2 / HIPAA attestation package
- .NET 10 LTS migration assessment
- Container base image hardening review
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 CLR monitoring, 15-min SLA, named .NET engineers.
- Everything in Assure
- 24/7 CLR and application health monitoring
- 15-minute P1 incident response SLA
- Named senior .NET engineer on your account
- GC pressure and memory leak alerting
- Kestrel and IIS performance monitoring
- .NET version migration execution
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Build stage
FROM artifacts.osseva.io/dotnet/sdk:6.0-osseva-1 AS build
WORKDIR /app
COPY *.csproj ./
RUN dotnet restore
COPY . .
RUN dotnet publish -c Release -o /app/publish
# Runtime stage
FROM artifacts.osseva.io/dotnet/aspnet:6.0-osseva-1
WORKDIR /app
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "MyApp.dll"]# Add OSSeva apt repository
curl -fsSL https://packages.osseva.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/osseva.gpg
echo "deb [signed-by=/usr/share/keyrings/osseva.gpg] https://packages.osseva.io/apt stable main" \
| sudo tee /etc/apt/sources.list.d/osseva.list
sudo apt-get update
sudo apt-get install -y osseva-dotnet-runtime-6.0Migrate from Microsoft .NET Support
Microsoft's .NET support lifecycle ends on a fixed date regardless of your application portfolio's readiness. OSSeva provides CVE coverage for .NET 6 and 7 past Microsoft's EOL, and for .NET 8 and 9 after 10 November 2026, with a structured migration assessment to .NET 10 LTS when your team is ready.
Pricing model
OSSeva for .NET is priced per application runtime environment, not per CPU core or per deployment.
Does OSSeva cover ASP.NET Core as well as the CLR runtime?
Yes. OSSeva's .NET coverage includes the full .NET runtime stack: CLR/CoreCLR, ASP.NET Core, Entity Framework Core, and the BCL (Base Class Library). CVEs in any of these layers are within scope for the covered versions.
We use .NET 7 (STS). Does OSSeva cover short-term support versions?
Yes. OSSeva covers both LTS and STS .NET versions. Many enterprises landed on .NET 7 because it was current when their project started — OSSeva provides CVE coverage past the 18-month Microsoft STS window while you plan the .NET 10 LTS migration.
Does OSSeva provide NuGet packages for patched .NET builds?
OSSeva delivers patched .NET runtimes as Windows installers and as Linux packages (apt, yum, binaries) and Docker images. For NuGet package scanning, OSSeva Assure includes transitive NuGet dependency vulnerability assessment for your application's dependency tree — we provide a prioritized remediation report for third-party packages.
What does the .NET 10 LTS migration assessment include?
The migration assessment covers: breaking API changes between your .NET version and .NET 10, NuGet dependency compatibility validation, ASP.NET Core configuration changes, Entity Framework Core migration path, and authentication/authorization middleware updates.
We deploy .NET in containers on Kubernetes. Is that supported?
Yes. OSSeva provides patched Docker base images for both the .NET SDK (build) and ASP.NET Core runtime (deployment) in Alpine and Debian variants. The images are drop-in replacements — update your FROM line, rebuild, redeploy.
Does OSSeva ship patched .NET for Windows as well as Linux?
Yes. OSSeva delivers patched .NET builds for Windows as installers, and for Linux as apt and yum packages, Docker images and binaries, all signed. This covers .NET (Core and 5 onwards), not Windows .NET Framework 4.x.
Does OSSeva cover Windows .NET Framework (not .NET Core / .NET 5+)?
OSSeva's current coverage focuses on .NET (Core / 5+) — the open-source, cross-platform runtime. Windows .NET Framework 4.x support is available as a professional services engagement. Contact us to discuss your .NET Framework requirements.
Who provides .NET support besides Microsoft?
Microsoft publishes each .NET release and ends its support on a fixed date. Other options are cloud managed services that run .NET for you and third-party support companies that cover versions after Microsoft's dates. OSSeva is a third-party option: one contract across your runtime, database and messaging stack, end-of-life .NET versions included, and patched builds that run wherever you run .NET.
Does OSSeva support current .NET versions or only end-of-life ones?
Both. OSSeva's support matrix lists .NET 6 and .NET 7 as end of life, and .NET 8, .NET 9 and .NET 10 as current, all with OSSeva patches active. Microsoft support for .NET 8 and 9 ends on 10 November 2026 and for .NET 10 LTS on 14 November 2028. The Patch tier covers .NET 6.x and 7.x today, 8.x and 9.x after Microsoft end of life on 10 November 2026, and 10.x after 14 November 2028.
How is OSSeva .NET support priced?
OSSeva .NET support is priced per application runtime environment. Patch covers quarterly CVE patches, Assure adds 24/7 reactive support, NuGet scanning and a .NET 10 LTS migration assessment, and Operate adds proactive 24/7 monitoring and managed operations with a 15-minute P1 SLA. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days. Book a discovery call for a quote.
Get a quote
Ready to get .NET patched and supported?
Tell us your .NET versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?