.NET 8.0.0 - November 14, 2023

The .NET 8.0.0 and .NET SDK 8.0.100 releases are available for download. The latest 8.0 release is always listed at .NET 8.0 Releases.

What's new in .NET 8

.NET 8 is the next major release of .NET following .NET 7.0. You can see What's new in .NET 8.0 for more details. You can also find additional details on the following blog posts:

• Announcing .NET 8
• EF Core
• ASP.NET Core

Here is list of some of the additions and updates we're excited to bring in .NET 8.

• EntityFramework Core: bugs | features
• .NET SDK bugs

Downloads

1. Includes the .NET Runtime and ASP.NET Core Runtime
2. For hosting stand-alone apps on Windows Servers. Includes the ASP.NET Core Module for IIS and can be installed separately on servers without installing .NET Runtime.

The .NET SDK includes a matching updated .NET Runtime. Downloading the Runtime or ASP.NET Core packages is not needed when installing the SDK.

You can check your .NET SDK version by running the following command. The example version shown is for this release.

$ dotnet --version
8.0.100

Docker Images

The .NET Docker images have been updated for this release. The .NET Docker samples show various ways to use .NET and Docker together. You can use the following command to try running the latest .NET 8.0 release in containers:

docker run --rm mcr.microsoft.com/dotnet/samples

The following repos have been updated.

• dotnet/sdk: .NET SDK
• dotnet/aspnet: ASP.NET Core Runtime
• dotnet/runtime: .NET Runtime
• dotnet/runtime-deps: .NET Runtime Dependencies
• dotnet/samples: .NET Samples

Notable Changes

.NET 8.0 Blog

.NET 8.0.0 release carries security and non-security fixes.

CVE-2023-36038 - .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 8.0 RC2. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A vulnerability exists in ASP.NET IIS where a remote unauthenticated user can issue specially crafted requests to a .NET application which may result in denial of service. This vulnerability only impacts Windows OS.

CVE-2023-36049 - .NET Elevation of Privilege Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0 RC2. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

An elevation of privilege vulnerability exists in .NET where untrusted URIs provided to System.Net.WebRequest.Create can be used to inject arbitrary commands to backend FTP servers.

CVE-2023-36558 - .NET Security Feature Bypass Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 6.0, ASP.NET Core 7.0 and, ASP.NET Core 8.0 RC2. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A security feature bypass vulnerability exists in ASP.NET where an unauthenticated user is able to bypass validation on Blazor server forms which could trigger unintended actions.

Visual Studio Compatibility

You need Visual Studio 17.8 or later to use .NET 8.0 on Windows. While not officially supported, we’ve also enabled rudimentary support for .NET 8 in Visual Studio for Mac. Users have to enable a preview feature in Preferences to enable the IDE to discover and use the .NET 8 SDK for creating, loading, building, and debugging projects. The C# extension for Visual Studio Code supports .NET 8.0 and C# 11.

Feedback

Your feedback is important and appreciated. We've created an issue at dotnet/core #8904 for your questions and comments.

Packages updated in this release: