Who contributed to .NET on August 21, 2026?

11 developers shipped this update, including Alexander Köplinger, dotnet-maestro, ViktorHofer, lewing, MihaZupan, jakobbotsch, jonathanpeppers, and Šimon Rozsíval, and 3 more.

What were the notable .NET updates?

Reject malformed SNI server names in Kestrel's SniOptionsSelector, Reject malformed SNI server names in Kestrel's SniOptionsSelector (#68015), and Unexpected DOM persistence: Omitted attributes not removed during re-render.

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

Kestrel blocks malformed SNI hostnames

By RepoJournal · Filed 07:06 UTC on August 21, 2026 · About .NET

11 people shipped this

dotnet-maestro @dotnet-maestro 3 cited

jakobbotsch @jakobbotsch 2 cited

TemRevil @TemRevil 2 cited

ViktorHofer @ViktorHofer 1 cited

jonathanpeppers @jonathanpeppers 1 cited

Vinoth2562000 @Vinoth2562000 1 cited

Alexander Köplinger @akoeplinger

lewing @lewing

MihaZupan @MihaZupan

Šimon Rozsíval @simonrozsival

Milos Kotlar @kotlarmilos

Kestrel now rejects malformed SNI server names, closing a DNS-label-boundary hole in the TLS handshake.

Kestrel's SniOptionsSelector accepted any ClientHello server_name string, and the wildcard path was a plain `EndsWith(suffix, OrdinalIgnoreCase)` scan that ignored DNS label boundaries [1]. That could let a crafted name, like one with an embedded null byte, slip past validation [2]. New checks `IsValidSniServerName` before both exact-name and wildcard lookups, so a handshake with a malformed name is now refused instead of misrouted [1]. Meanwhile Blazor fixed a DOM persistence bug where omitted attributes from `CaptureUnmatchedValues` stayed in the browser [3]. And the .NET JIT is trimming its walking infrastructure: fgWalkTree callbacks are being replaced with direct GenTreeVisitor implementations [4]. The move also deletes the old fgWalkData plumbing, and filling uninitialized memory with 0xcd is now the constant default, shaving 2.90% off checked-JIT instructions retired [5]. Android teams get a concurrency fix for FastTiming that stops heap corruption under sustained typemap load [6]. On the platform side, .NET 11.0.100-rc.1.26420.103 updates are flowing in [7], and aspnetcore, roslyn, and msbuild codeflow PRs are landing in dotnet/dotnet [8] [9] [10]. The Kestrel SNI validation and the Blazor DOM fix are immediate wins; the JIT refactor is a quieter but solid cleanup.

Action items

→ Patch Kestrel to reject malformed SNI server names before your next deploy dotnet/aspnetcore [immediate]
→ Review Blazor rendered attributes when using CaptureUnmatchedValues to avoid stale DOM state dotnet/aspnetcore [plan]
→ Monitor .NET 11 preview updates and the JIT refactor for regression risk dotnet/runtime [monitor]

References

[1] Reject malformed SNI server names in Kestrel's SniOptionsSelector ↗ dotnet/aspnetcore
[2] Reject malformed SNI server names in Kestrel's SniOptionsSelector (#68015) dotnet/aspnetcore
[3] Unexpected DOM persistence: Omitted attributes not removed during re-render ↗ dotnet/aspnetcore
[4] JIT: replace fgWalkTree callbacks with GenTreeVisitor implementations ↗ dotnet/runtime
[5] JIT: Always fill uninitialized JIT memory with 0xcd ↗ dotnet/runtime
[6] [native] Fix concurrent FastTiming event storage ↗ dotnet/android
[7] .NET 11.0.100-rc.1.26420.103 Updates ↗ dotnet/dotnet
[8] [main] Source code updates from dotnet/aspnetcore ↗ dotnet/dotnet
[9] [main] Source code updates from dotnet/roslyn ↗ dotnet/dotnet
[10] [main] Source code updates from dotnet/msbuild ↗ dotnet/dotnet

Quick answers

What shipped in .NET on August 21, 2026?: Kestrel now rejects malformed SNI server names, closing a DNS-label-boundary hole in the TLS handshake. In total, 39 commits and 41 pull requests landed.
Who contributed to .NET on August 21, 2026?: 11 developers shipped this update, including Alexander Köplinger, dotnet-maestro, ViktorHofer, lewing, MihaZupan, jakobbotsch, jonathanpeppers, and Šimon Rozsíval, and 3 more.
What were the notable .NET updates?: Reject malformed SNI server names in Kestrel's SniOptionsSelector, Reject malformed SNI server names in Kestrel's SniOptionsSelector (#68015), and Unexpected DOM persistence: Omitted attributes not removed during re-render.

Android CI tightens the net

The .NET Android team is hardening the deployment pipeline, and skipping unchanged framework assemblies could be the biggest win you're not expecting.

dotnet 36 shipped

@dotnet Aug 20

SIGNALR CLOSES DUPLICATE STREAM HOLE

A protocol-invalid duplicate stream ID could leave the displaced hub argument permanently unreachable, and now it's rejected immediately.

dotnet 131 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.

dotnet 46 shipped

@dotnet Aug 18

MSBuild's telemetry failure can kill your build

A NullReferenceException in MSBuild's telemetry disposal is silently taking down .NET Framework builds.

dotnet 49 shipped

Elsewhere on the wire

AI Agents Aug 22

Cline hubs get drain and replay as Langchain plumb gates

Cline just shipped rollover-grade hub commands while Langchain exposes gateway internals, and OpenHands quietly broke its own monitoring contract.

ai-agents 42 shipped

Local LLMs Aug 22

SGLang ships v0.5.18 with 710 PRs and DeepSeek V4 FP4 auto-routing

The biggest release of the week just landed: SGLang v0.5.18 adds new models, fixes a silent disagg bug, and defaults DeepSeek V4 FP4 checkpoints to the right MoE runner.