Note that this affects ".net core", not ".net framework"
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Listed as affected at the top in the github post is ASP .NET Core 2.3
ASP .NET Core 2.3 is a .NET Framework package, as explained by https://devblogs.microsoft.com/dotnet/servicing-release-advi...
It was released in February 2025, for those who think framework isn't supported.
That started in .NET 5.0 in November 2020, which was nearly 5 years ago now.
The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET.
--- edit: cut here - the sentence below is incorrect! ---
If somehow you were still using legacy ASP.NET / Framework 4.8 etc, you have much bigger problems - legacy ASP.NET has been unsupported since 2022 so will definitely not be receiving security updates.
This is, IMO, a bad thing, and Microsoft needs to break this chain at some point, at least for ASP.NET. But, it is still technically supported.
Sorry, I did not know they had actually brought non-Core ASP.NET forward into 5.0+, but it makes sense given how much of .NET Framework they continued support for and how much ASP.NET and Forms stuff is still around in enterprise with no budget for bringing it forward.
Totally agree with breaking the chain though, we moved to Core around 2.0 and never looked back, as an ecosystem it is so much better.
None of this is true, you've gotten yourself very confused. The only real change with .NET 5 was the "Core" name being dropped and the Mono runtime being merged in. .NET Framework 4.x is still around and is still fully supported for legacy applications.
And there is currently no official other supported version supported like .NET Framework 4.8 or simply .NET
I don't think this is correct:
.NET 4.8 / 4.8.1 shows does not have an end of support date set: https://dotnet.microsoft.com/en-us/platform/support/policy/d...
Also ASP.NET MVC 5 does not have an end of support date set: https://dotnet.microsoft.com/en-us/platform/support/policy/a...
There are plenty of apps out there were there is no feasible upgrade path to .NET Core / .NET 9, so I imagine MS will continue to support these for a very long time. Note that the VB6 runtime is still supported in all Windows operating systems: https://learn.microsoft.com/en-us/previous-versions/visualst...
We had code using WCF and AppDomains that were always out of scope for .NET Core. WCF has a Core replacement now that is not quite one-for-one but AppDomains will never be supported in .NET Core / .NET 5.0+ and would indeed have to stay on 4.8 / 4.8.1 if they were still running.
https://learn.microsoft.com/en-us/dotnet/fundamentals/implem...
There is both a .Net and a .Net Framework, with the latest .net framework update being about ~3 years old, years after .net 5 was released.
I'm finally working on migrating (migrate, not upgrade) from .Net framework 4.7.2 to .Net 9
It was a previously impossible / very difficult due to strong dependencies on functionality which only existed in .Net Framework.
With the continued development of Winforms on .Net 9+, it finally made sense to start migrating over.
Additionally the mistake to rename .NET Core as .NET is the main reason many people still think .NET is Windows only.
But yes, choosing ".NET" as the new name was a bad idea, since now when someone says .NET you have no idea if they are referring to the modern runtime, or its various generations collectively.