Secure EOL .NET without rewriting your application or rushing an upgrade
Endless Lifecycle Support delivers post-EOL CVE fixes for
.NET 6, 8, and 10, covering the .NET Runtime, SDK, ASP.NET
Core Runtime, and Desktop Runtime, so you reduce risk
without disruption.
Jump to:
Talk to Us
Ask about coverage, SLAs, pricing, or anything else.
Covered .NET Versions
End of support:
November 12, 2024
Covered by ELS
End of support:
May 14, 2024
Covered by ELS
End of support:
November 10, 2026
Covered by ELS
End of support:
November 2028
Covered by ELS
Security Fixes We’ve Delivered to EOL .NET Versions
High & Critical Severity CVEs
Coverage for the .NET Components You Use
Choose the component that matches how your teams build, host, and run .NET applications.
.NET SDK
Develop, build, test, and publish applications with the CLI, compilers, and build tools; includes the runtimes below.
ASP.NET Core Runtime
Keep hosting web applications and services on a security-maintained runtime.
.NET Runtime
Run console applications, background services, and APIs without the full development toolchain.
.NET Desktop Runtime
Keep WPF and Windows Forms applications running on their existing .NET foundation.
What You Get with ELS
CVE Patching for Unsupported .NET
As new .NET vulnerabilities are disclosed, TuxCare investigates, backports, tests, and ships updates for covered EOL versions, helping you stay protected after Microsoft support ends.
On day 1
ELS gives you access to existing fixes for known CVEs affecting your covered .NET version and components.
Keep Your Setup. Extend Your Security.
ELS preserves the .NET version, application behavior, and deployment patterns your teams already rely on. No refactoring, no forced move to a new major release.
ELS works across
Windows Server 2012 through 2025, Windows Server Core, Nano Server, Windows 10 and 11, on x64 and x86, installed through the same .exe and .msi installers your team already uses.
Support That Holds Up to Review
SLA-Backed Patch Delivery
TuxCare’s patch delivery SLA helps your organization meet vulnerability remediation expectations under frameworks and regulations such as SOC 2, NIS2, PCI DSS, HIPAA, DORA, and the CRA.
Enterprise Support Guarantees
ELS is built for enterprise use, with commercial support terms and contractual protections designed for organizations that need more than community best-effort maintenance.
Plug ELS into the stack you already have in minutes with no code changes required
Compatible across:
Windows 11
Windows 10Windows Server CoreWindows Server 2012–2025Nano ServerA head start on .NET security
Adopt ELS and benefit from the fixes already delivered for your version, plus continued vulnerability monitoring and patching as new .NET CVEs appear.
| CVE | Component | Severity | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42899 | ASP.NET Core | High | An unreachable loop exit condition can be triggered remotely, causing denial of service. | |
| CVE-2026-32178 | System.Net.Mail | High | Email address parsing accepts injected characters, enabling SMTP command/header injection. | |
| CVE-2026-26131 | .NET 10 (Linux install) | High | Incorrect file permissions on .NET 10 (Linux) can let a local user escalate privileges. | |
| CVE-2026-26127 | .NET Runtime | High | An out-of-bounds read can crash an application remotely without authentication. | |
| CVE-2026-25667 | Kestrel (HTTP/3) | High | A crafted QUIC packet can cause excessive CPU usage, denying service. | |
| CVE-2026-21218 | .NET Runtime (COSE) | High | Improper exception handling lets an attacker bypass signature validation. | |
| CVE-2025-30399 | .NET Runtime | High | An untrusted search path can let an attacker trigger unintended code execution. | |
| CVE-2025-26682 | ASP.NET Core (HTTP/3) | High | Unlimited HTTP/3 resource allocation lets an attacker cause denial of service. | |
| CVE-2025-24070 | ASP.NET Core (Authentication) | High | A flaw in sign-in validation lets an attacker impersonate another user’s account. | |
| CVE-2024-38229 | ASP.NET Core (HTTP/3) | High | A race condition in HTTP/3 stream handling can lead to remote code execution. | |
| CVE-2024-38168 | ASP.NET (HTTP.sys) | High | Unauthenticated requests to HTTP.sys-hosted apps can cause denial of service. | |
| CVE-2024-38081 | .NET / Visual Studio Installer | High | A local file-manipulation flaw during installation can escalate privileges. | |
| CVE-2024-26190 | MsQuic (QUIC protocol) | High | Malicious QUIC connections can force excessive memory allocation, causing denial of service. | |
| CVE-2024-0057 | .NET (X.509 validation) | Critical | A certificate validation logic flaw can let an invalid trust chain appear valid. | |
| CVE-2023-36049 | .NET (System.Net.WebRequest) | Critical | Untrusted URIs can inject FTP commands — a widely known critical .NET flaw. | |
| CVE-2023-35391 | ASP.NET Core (SignalR) | High | SignalR with a Redis backplane can leak information between user connections. | |
| CVE-2023-33135 | .NET SDK | High | A flaw during tool restore can be exploited to escalate local privileges. | |
| CVE-2022-24464 | ASP.NET Core (FormPipeReader) | High | Crafted multipart form data can trigger denial of service. | |
| CVE-2022-21986 | Kestrel (HTTP/2, HTTP/3) | High | Malformed HTTP/2 and HTTP/3 requests can crash the Kestrel web server. |
Ask a .NET
CVE Patching Expert
Talk to us about ELS coverage, implementation, compliance, or pricing for your .NET environment.
How Does It Work?
We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.
Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.
Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.
Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.
How Teams Use ELS
Close the CVE exposure window
⚠️ The bind:
Business-critical APIs, web services, and desktop systems are pinned to EOL .NET 6. Scanners flag every deploy, Microsoft ships no further patches, and each new CVE widens the gap between disclosure and exploit.
🔄 The turn:
ELS resumes SLA-backed patching for covered .NET – signed, regression-tested builds of the runtime, SDK, and ASP.NET Core, installed through standard installers with no code changes. Backed by 24/7 CVE tracking.
Close an open audit finding
⚠️ The bind:
Internal audit, SOC 2, and a customer questionnaire all flag EOL .NET, and Microsoft will never patch it, so there’s no remediation date to give auditors or the board.
🔄 The turn:
ELS delivers a named, vendor-backed runtime under a contractual SLA, with CSAF VEX documents in every release. Findings close with documented remediation aligned with PCI DSS, HIPAA, SOC 2, DORA, NIS2, and CRA.
Migrate on your terms, not the EOL clock
⚠️ The bind:
Every .NET release buys just three years of support (LTS) or two (STS, like 7), and moving from 6 to 7 to 8 to 10 means breaking changes, dependency updates, and regression testing across hundreds of projects.
🔄 The turn:
ELS drops in estate-wide (on-prem or across AWS, Azure, and GCP) with no code changes. You get years of runway to sequence upgrades around business priorities instead of treating an EOL date as an emergency deadline.
Why TuxCare?
420,000+
Patches Delivered
From the Team That Extends Open-Source Lifecycles
TuxCare keeps essential components protected long after upstream support ends, from the Linux kernel to language runtimes like Node.js. One partner, whole-stack coverage.
14,000+
Vulnerabilities Fixed
Founding platinum sponsor of the AlmaLinux OS Foundation and member of the Open Source Security Foundation (OpenSSF).
TuxCare invests in the open-source ecosystem it secures, from Node.js to Linux, and beyond.
Learn more →
70,000+
Packages Curated
2,700+
Enterprise Clients
Related Insights
.NET 6 End of Life: What It Means for Your Business in 2026
Key Takeaways .NET 7 is no longer supported — migrating to a supported version...
.NET 8 End of Life: Key Dates, Risks & Next Steps Now
Key Takeaways .NET 6 reached End of Life on November 12, 2024, leaving systems...
Critical .NET Security Alert: CVE-2025-24070 Impacts .NET 6 Despite...
Our security research team has identified that the recently disclosed vulnerability...
Secure Your EOL .NET Versions
Talk to our team about protecting unsupported .NET runtimes and components without code changes, rushed migrations, or an open-ended CVE backlog.
Ask Us a Question
Frequently Asked Questions
Documentation currently lists .NET 6, .NET 8, and .NET 10. .NET 6 is already past end of support; coverage for .NET 8 and .NET 10 provides continuity as those releases reach their official end-of-support dates. Other versions and architectures are available upon request — contact [email protected].
No. ELS delivers patched builds of the same .NET version your application runs on today, installed through standard .exe and .msi installers. Your code, project files, and deployment process stay unchanged. As with any runtime update, application-specific testing before production rollout is recommended.
The .NET SDK, .NET Runtime, ASP.NET Core Runtime, and .NET Desktop Runtime (WPF and Windows Forms). Install the component that matches your workload, or the SDK to get everything bundled.
Supported editions of Windows 10, Windows 11, Windows Server, Windows Server Core, and Nano Server, on x64 (and x86 for selected Windows Server versions). Supported environments vary by .NET release; other operating systems and architectures may be available upon request.
Patch delivery is backed by TuxCare's SLA, supporting remediation timelines under SOC 2, NIS2, PCI DSS, HIPAA, DORA, and the CRA.
Yes, .NET versions can generally run side by side, which helps teams transition gradually. Use dotnet --list-sdks and dotnet --info to inventory installed versions, and validate deployments before removing older components.
ELS gives you a documented, vendor-backed process for remediating vulnerabilities in EOL software: SLA-backed delivery, commercial support terms, and an SBOM with each release. That turns an unowned audit exception into managed, evidenced coverage, though each organization determines how the service maps to its specific regulatory obligations.
ELS doesn't replace modernization. It removes the deadline pressure. You get additional secure runway so migrations can be planned around business priorities, testing requirements, and engineering capacity rather than an EOL date.