OSSEVA FOR .NET
.NET — patched, protected, operated.
Drop-in CVE patches for .NET 6 and .NET 8 — including short-term support (STS) versions Microsoft has moved past. OSSeva provides CVE coverage for the .NET versions your enterprise applications run on, without forcing a runtime upgrade on Microsoft's schedule.
Why now
.NET STS versions have 18-month support windows
.NET 7 reached EOL in May 2024 after only 18 months. Microsoft's alternating LTS/STS release pattern means enterprises that miss an LTS version face rapid EOL exposure. OSSeva covers both LTS and STS versions past Microsoft's support window.
.NET 6 LTS ended November 2024 — millions of enterprise apps affected
.NET 6 was an LTS release but reached EOL in November 2024. Enterprise applications that depend on .NET 6 APIs, including Azure Functions and ASP.NET Core applications, are now running without upstream CVE patches.
NuGet supply chain and CLR deserialization CVEs compound the risk
Beyond runtime CVEs, .NET applications face NuGet dependency supply chain risk and CLR-level deserialization vulnerabilities. OSSeva monitors both the runtime and common enterprise NuGet packages for the covered .NET versions.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| .NET 6.0 (LTS)(Community EOL Nov 2024) | EOL | Clean |
| .NET 7.0 (STS)(Community EOL May 2024) | EOL | Clean |
| .NET 8.0 (LTS)(LTS through Nov 2026) | Current | Clean |
| .NET 9.0 (STS)(Current) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for .NET 6 and 7 past Microsoft EOL.
- Quarterly CVE patches for .NET 6.x and 7.x
- ASP.NET Core and CLR CVE coverage
- Docker / apt / yum / binary delivery
- Signed artifacts (GPG + Sigstore)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus NuGet scanning, compliance docs, and migration planning.
- Everything in Patch
- NuGet dependency vulnerability scanning
- ASP.NET Core TLS and authentication configuration review
- SOC 2 / HIPAA attestation package
- .NET 8 LTS migration assessment
- Container base image hardening review
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 CLR monitoring, 15-min SLA, named .NET engineers.
- Everything in Assure
- 24/7 CLR and application health monitoring
- 15-minute P1 incident response SLA
- Named senior .NET engineer on your account
- GC pressure and memory leak alerting
- Kestrel and IIS performance monitoring
- .NET version migration execution
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Build stage
FROM artifacts.osseva.io/dotnet/sdk:6.0-osseva-1 AS build
WORKDIR /app
COPY *.csproj ./
RUN dotnet restore
COPY . .
RUN dotnet publish -c Release -o /app/publish
# Runtime stage
FROM artifacts.osseva.io/dotnet/aspnet:6.0-osseva-1
WORKDIR /app
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "MyApp.dll"]# Add OSSeva apt repository
curl -fsSL https://packages.osseva.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/osseva.gpg
echo "deb [signed-by=/usr/share/keyrings/osseva.gpg] https://packages.osseva.io/apt stable main" \
| sudo tee /etc/apt/sources.list.d/osseva.list
sudo apt-get update
sudo apt-get install -y osseva-dotnet-runtime-6.0Migrate from Microsoft .NET Support
Microsoft's .NET support lifecycle ends on a fixed date regardless of your application portfolio's readiness. OSSeva provides CVE coverage for .NET 6 and 7 past Microsoft's EOL, with a structured migration assessment to .NET 8 LTS when your team is ready.
Pricing model
OSSeva for .NET is priced per application runtime environment — not per CPU core or per deployment. Contact for scoping.
Compliance library
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get .NET patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.