RepoJournal
.NET @dotnet
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-21
stories 80
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Kestrel blocks malformed SNI hostnames

By RepoJournal · Filed · About .NET · Composed from the cited sources · methodology

dotnet-maestro jakobbotsch TemRevil ViktorHofer jonathanpeppers Vinoth2562000 Alexander Köplinger
11 people shipped this
dotnet-maestro @dotnet-maestro 3 cited jakobbotsch @jakobbotsch 2 cited TemRevil @TemRevil 2 cited ViktorHofer @ViktorHofer 1 cited jonathanpeppers @jonathanpeppers 1 cited Vinoth2562000 @Vinoth2562000 1 cited Alexander Köplinger @akoeplinger lewing @lewing MihaZupan @MihaZupan Šimon Rozsíval @simonrozsival Milos Kotlar @kotlarmilos

Kestrel now rejects malformed SNI server names, closing a DNS-label-boundary hole in the TLS handshake.

Kestrel's SniOptionsSelector accepted any ClientHello server_name string, and the wildcard path was a plain `EndsWith(suffix, OrdinalIgnoreCase)` scan that ignored DNS label boundaries [1]. That could let a crafted name, like one with an embedded null byte, slip past validation [2]. New checks `IsValidSniServerName` before both exact-name and wildcard lookups, so a handshake with a malformed name is now refused instead of misrouted [1]. Meanwhile Blazor fixed a DOM persistence bug where omitted attributes from `CaptureUnmatchedValues` stayed in the browser [3]. And the .NET JIT is trimming its walking infrastructure: fgWalkTree callbacks are being replaced with direct GenTreeVisitor implementations [4]. The move also deletes the old fgWalkData plumbing, and filling uninitialized memory with 0xcd is now the constant default, shaving 2.90% off checked-JIT instructions retired [5]. Android teams get a concurrency fix for FastTiming that stops heap corruption under sustained typemap load [6]. On the platform side, .NET 11.0.100-rc.1.26420.103 updates are flowing in [7], and aspnetcore, roslyn, and msbuild codeflow PRs are landing in dotnet/dotnet [8] [9] [10]. The Kestrel SNI validation and the Blazor DOM fix are immediate wins; the JIT refactor is a quieter but solid cleanup.

Action items

References

  1. [1] Reject malformed SNI server names in Kestrel's SniOptionsSelector ↗ dotnet/aspnetcore
  2. [2] Reject malformed SNI server names in Kestrel's SniOptionsSelector (#68015) ↗ dotnet/aspnetcore
  3. [3] Unexpected DOM persistence: Omitted attributes not removed during re-render ↗ dotnet/aspnetcore
  4. [4] JIT: replace fgWalkTree callbacks with GenTreeVisitor implementations ↗ dotnet/runtime
  5. [5] JIT: Always fill uninitialized JIT memory with 0xcd ↗ dotnet/runtime
  6. [6] [native] Fix concurrent FastTiming event storage ↗ dotnet/android
  7. [7] .NET 11.0.100-rc.1.26420.103 Updates ↗ dotnet/dotnet
  8. [8] [main] Source code updates from dotnet/aspnetcore ↗ dotnet/dotnet
  9. [9] [main] Source code updates from dotnet/roslyn ↗ dotnet/dotnet
  10. [10] [main] Source code updates from dotnet/msbuild ↗ dotnet/dotnet

$ ls dotnet/reviews/ # the step-back reads

the week in review CVE-2026-69304 hits ASP.NET Core; Spark 4.0 support lands the month in review F# interpolated strings and record spreads land as Orleans and runtime harden
Full archive → Weekly reviews →

Quick answers

What shipped in .NET on August 21, 2026?
Kestrel now rejects malformed SNI server names, closing a DNS-label-boundary hole in the TLS handshake. In total, 39 commits and 41 pull requests landed.
Who contributed to .NET on August 21, 2026?
11 developers shipped this update, including Alexander Köplinger, dotnet-maestro, ViktorHofer, lewing, MihaZupan, jakobbotsch, jonathanpeppers, and Šimon Rozsíval, and 3 more.
What were the notable .NET updates?
Reject malformed SNI server names in Kestrel's SniOptionsSelector, Reject malformed SNI server names in Kestrel's SniOptionsSelector (#68015), and Unexpected DOM persistence: Omitted attributes not removed during re-render.
♥

$ log @dotnet --recent

Vector literals stop breaking under comma-decimal cultures, AIDL one-way proxies generate correctly 83 shipped Spark 4.0 lands in .NET bindings, arcade refreshes Entra tokens mid-job 23 shipped MSBuild TaskAnalyzer quiets three diagnostics, Terminal Logger stops corrupting shared log events 20 shipped MAUI backports iOS regression coverage, aspnetcore bumps extensions 6 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training GSM8K scoring parses answers as exact decimals AI Red Teaming PyRIT closes a judge-spoofing hole, promptfoo accepts Langfuse v6

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.