.NET 8.0.26 - April 14, 2026

The .NET 8.0.26 and .NET SDK 8.0.420 releases are available for download. The latest 8.0 release is always listed at .NET 8.0 Releases.

8.0 SDKs that include 8.0.26 runtimes:

• 8.0.420
• 8.0.126

Downloads

1. Includes the .NET Runtime and ASP.NET Core Runtime
2. For hosting stand-alone apps on Windows Servers. Includes the ASP.NET Core Module for IIS and can be installed separately on servers without installing .NET Runtime.

The .NET SDK includes a matching updated .NET Runtime. Downloading the Runtime or ASP.NET Core packages is not needed when installing the SDK.

You can check your .NET SDK version by running the following command. The example version shown is for this release.

$ dotnet --version
8.0.420

Docker Images

The .NET Docker images have been updated for this release. The .NET Docker samples show various ways to use .NET and Docker together. You can use the following command to try running the latest .NET 8.0 release in containers:

docker run --rm mcr.microsoft.com/dotnet/samples

Notable Changes

.NET 8.0.26 release carries security and non-security fixes.

CVE-2026-26171 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where uncontrolled resource consumption can give an attacker to the ability to perform a Denial of Service attack.

CVE-2026-32203 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack.

CVE-2026-33116 | .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack.

CVE-2026-32178 | .NET Spoofing Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network.

Note on System.Security.Cryptography.Xml.EncryptedXml or System.Security.Cryptography.Xml.SignedXml

Applications using System.Security.Cryptography.Xml.EncryptedXml or System.Security.Cryptography.Xml.SignedXml might encounter two new CryptographicException occurrences when processing deeply nested payloads or entities with unsafe transforms.

1. “The XML element has exceeded the maximum nesting depth allowed for decryption.”

This is a new exception message that can only be thrown from the new behavior. This exception indicates the XML being processed has a deeply nested XML structure beyond a new default depth limit of 64. This limit can be overridden with a different numeric value, and a value of 0 indicates “no limit,” which restores the previous behavior.

• .NET Framework: Set a registry value named CryptoXmlDangerousMaxRecursionDepth within HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT.NETFramework\Security

• .NET: Set an AppContext property named System.Security.Cryptography.Xml.DangerousMaxRecursionDepth

2. “The specified cryptographic transform is not supported.”

Exceptions with this message were reachable before this update, but there are new circumstances where this exception can now be thrown. This exception indicates the XML payload is attempting to apply a transform not included in the known safe transforms list.

The safe transforms are:

SignedXml.XmlDsigC14NTransformUrl SignedXml.XmlDsigC14NWithCommentsTransformUrl SignedXml.XmlDsigExcC14NTransformUrl SignedXml.XmlDsigExcC14NWithCommentsTransformUrl SignedXml.XmlDsigBase64TransformUrl SignedXml.XmlLicenseTransformUrl SignedXml.XmlDecryptionTransformUrl

The previous behavior can be restored by applying an override.

• .NET Framework: Set a registry value named EncryptedXmlAllowDangerousTransforms to a non-zero numeric value within HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT.NETFramework\Security
• .NET: Set an AppContext property named System.Security.Cryptography.Xml.AllowDangerousEncryptedXmlTransforms to ‘true’.

Visual Studio Compatibility

You need Visual Studio 17.10 or later to use .NET 8.0 on Windows. While not officially supported, we’ve also enabled rudimentary support for .NET 8.0 in Visual Studio for Mac. Users have to enable a preview feature in Preferences to enable the IDE to discover and use the .NET 8.0 SDK for creating, loading, building, and debugging projects. The C# extension for Visual Studio Code supports .NET 8.0 and C# 12.

Feedback

Your feedback is important and appreciated. We've created an issue at dotnet/core 10356 for your questions and comments.

Packages updated in this release