.NET 10.0.6 - April 14, 2026

The .NET 10.0.6 release is available for download. The latest 10.0 release is always listed at .NET 10.0 Releases.

10.0 SDKs that include 10.0.6 runtimes:

• 10.0.202
• 10.0.106

Downloads

1. Includes the .NET Runtime and ASP.NET Core Runtime
2. For hosting stand-alone apps on Windows Servers. Includes the ASP.NET Core Module for IIS and can be installed separately on servers without installing .NET Runtime.

The .NET SDK includes a matching updated .NET Runtime. Downloading the Runtime or ASP.NET Core packages is not needed when installing the SDK.

You can check your .NET SDK version by running the following command. The example version shown is for this release.

.NET SDK 10.0.202

$ dotnet --version
10.0.202

Visit .NET Documentation to learn about .NET, for building many different types of applications.

Docker Images

The .NET Docker images have been updated for this release. The .NET Docker samples show various ways to use .NET and Docker together. You can use the following command to try running the latest .NET 10 container image:

docker run --rm mcr.microsoft.com/dotnet/samples

Notable Changes

.NET 10.0.6 release carries security and non-security fixes.

CVE-2026-26171 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where uncontrolled resource consumption can give an attacker to the ability to perform a Denial of Service attack.

CVE-2026-32203 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack.

CVE-2026-33116 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack.

CVE-2026-32178 | .NET Spoofing Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network.

Note on System.Security.Cryptography.Xml.EncryptedXml or System.Security.Cryptography.Xml.SignedXml

Applications using System.Security.Cryptography.Xml.EncryptedXml or System.Security.Cryptography.Xml.SignedXml might encounter two new CryptographicException occurrences when processing deeply nested payloads or entities with unsafe transforms.

1. “The XML element has exceeded the maximum nesting depth allowed for decryption.”

This is a new exception message that can only be thrown from the new behavior. This exception indicates the XML being processed has a deeply nested XML structure beyond a new default depth limit of 64. This limit can be overridden with a different numeric value, and a value of 0 indicates “no limit,” which restores the previous behavior.

• .NET Framework: Set a registry value named CryptoXmlDangerousMaxRecursionDepth within HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT.NETFramework\Security

• .NET: Set an AppContext property named System.Security.Cryptography.Xml.DangerousMaxRecursionDepth

2. “The specified cryptographic transform is not supported.”

Exceptions with this message were reachable before this update, but there are new circumstances where this exception can now be thrown. This exception indicates the XML payload is attempting to apply a transform not included in the known safe transforms list.

The safe transforms are:

SignedXml.XmlDsigC14NTransformUrl SignedXml.XmlDsigC14NWithCommentsTransformUrl SignedXml.XmlDsigExcC14NTransformUrl SignedXml.XmlDsigExcC14NWithCommentsTransformUrl SignedXml.XmlDsigBase64TransformUrl SignedXml.XmlLicenseTransformUrl SignedXml.XmlDecryptionTransformUrl

The previous behavior can be restored by applying an override.

• .NET Framework: Set a registry value named EncryptedXmlAllowDangerousTransforms to a non-zero numeric value within HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT.NETFramework\Security
• .NET: Set an AppContext property named System.Security.Cryptography.Xml.AllowDangerousEncryptedXmlTransforms to ‘true’.

Visual Studio Compatibility

If you're on Windows, we recommend installing the latest version of Visual Studio 18.4. Read more about this new release on the Visual Studio blog and release notes.

You can also use Visual Studio Code and the C# Dev Kit extension with .NET 10.

Feedback

Your feedback is important and appreciated. We've created an issue at dotnet/core 10356 for your questions and comments.

Packages updated in this release