[Question]: .NET 8.0.21

[jfischervpt]

Describe your question

Is there a plan and targeted date to update .NET to address vulnerabilities disclosed 10/14/2025?

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315

https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.21/8.0.21.md

Versions

Azure VM extension using:
vsts-agent-linux-x64-4.261 through vsts-agent-linux-x64-4.264.2

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Operation system

Ubuntu 24.04

Version controll system

No response

Azure DevOps Server Version (if applicable)

No response

[peterwishart]

I assume its not vulnerable to CVE-2025-55315, as it doesn't use ASP.NET Core Runtime - it only connects outbound to the dev.azure.com servers.

[jfischervpt]

While CVE-2025-55315 is the explicit example listed, it is not the only vulnerability addressed in the recent release. The question still stand of when the updated version will be implemented into agent.