.NET 10.0.9

Release Date: June 9, 2026

Microsoft has released .NET 10.0.9, a servicing update for the .NET 10 LTS release line. This update includes critical security fixes and addresses several non-security issues across the runtime, ASP.NET Core, and the .NET SDK.

Overview

.NET 10.0.9 is a cumulative update that replaces all previous .NET 10 updates. The latest SDK is 10.0.301, which includes the 10.0.9 runtime and ASP.NET Core packages. This release carries both security and non-security fixes.

Security Fixes

Three CVEs are addressed in this release:

CVE-2026-45591 (CVSS 7.5) — ASP.NET Core Denial of Service Vulnerability. Uncontrolled recursion in ASP.NET Core (SignalR and Blazor Server) allows an unauthorized attacker to deny service over a network by sending deeply-nested MessagePack arrays.
CVE-2026-45491 (CVSS 6.8) — .NET Elevation of Privilege Vulnerability. Improper limitation of a pathname to a restricted directory (path traversal) in System.Formats.Tar allows an unauthorized attacker to write arbitrary files via a symbolic link.
CVE-2026-45490 (CVSS 6.0) — .NET Elevation of Privilege Vulnerability. Improper handling of a named pipe in the .NET SDK allows an authorized attacker to create or truncate arbitrary files locally.

Non-Security Improvements

Beyond the security patches, this release includes various reliability and performance fixes across the stack:

ASP.NET Core runtime stability improvements for long-running SignalR connections
Windows Forms high-DPI rendering fixes for per-monitor DPI scenarios
Native AOT compiler edge case fixes for Linux ARM64 deployments
Improvements to the MSBuild incremental build safety checks
Entity Framework Core 10.0.9 includes query optimization fixes for complex LINQ expressions

Packages Updated

Key NuGet packages updated in this release include AspNetCoreRuntime.10.0.x64, Microsoft.AspNetCore.App.Ref, Microsoft.NETCore.App.Ref, and dotnet-ef, among others. A full list is available in the official release notes on GitHub.

Compatibility

.NET 10.0.9 is compatible with Visual Studio 18.6.3 and 18.7.0 on Windows. For macOS and Linux users, the SDK can be installed via the dotnet-install scripts or package managers. Docker images are updated on Microsoft Artifact Registry.

How to Update