Issues

• CertificateAuthentication: CustomTrustStore/CustomRootTrust is not applied to self-signed client certificates

  area-authbugfeature-authentication
  dotnet/aspnetcore#69763 · Filter by author rokonec opened on Oct 10, 2026
  2

• ANCM aspnetcorev2.dll 20.0.26234.12 crashes w3wp with heap corruption (double free in FLS callback) when the worker process shuts down

  area-networkingfeature-iis
  Bug

  dotnet/aspnetcore#69762 · Filter by author ericks-rs opened on Oct 10, 2026
  2

• RouteHandlerAnalyzer: NullReferenceException (AD0001) when the handler is a delegate creation, new Func<int, string>(Method), or a lambda under a cast

  area-minimal
  Bug

  dotnet/aspnetcore#69760 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• Request Delegate Generator: an intercepted MapFallback endpoint is registered with order 0 instead of int.MaxValue, and without its fallback metadata

  area-minimalNativeAOT
  Bug

  dotnet/aspnetcore#69759 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• Request Delegate Generator: a double parameter defaulting to -0.0 receives +0.0 (the generated fallback is the int expression -0); a decimal -0.0m loses its sign too

  area-minimalNativeAOT
  Bug

  dotnet/aspnetcore#69758 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• Request Delegate Generator: MapFallback(handler) and MapFallback(pattern, handler) with handlers of the same signature share one interceptor, build error CS9144

  area-minimalNativeAOT
  Bug

  dotnet/aspnetcore#69757 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• Request Delegate Generator: a string bound through [FromQuery], [FromHeader] or [FromRoute] receives null instead of its default value

  area-minimalNativeAOT
  Bug

  dotnet/aspnetcore#69756 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• Request Delegate Generator: InvalidCastException at the Map call for a params handler, and for a method converted to a named delegate type or, with a default value, to Func<>

  area-minimalNativeAOT
  Bug

  dotnet/aspnetcore#69755 · Filter by author AdCodicem opened on Oct 10, 2026
  1

• MapStaticAssets: builder conventions (e.g. RequireAuthorization) are not applied to the runtime fallback endpoint

  area-middlewarearea-securityfeature-static-files
  dotnet/aspnetcore#69754 · Filter by author rokonec opened on Oct 9, 2026

• FormFeature.ReadFormAsync can return a null Task when the body completes on another thread (NullReferenceException in OpenIdConnectHandler)

  area-networking
  Bug

  dotnet/aspnetcore#69744 · Filter by author olisago opened on Oct 9, 2026
  1

• The new IISHostLifetime implementation introduced with .NET 10 isn't logging Microsoft.Hosting.Lifetime events

  area-networkingfeature-iisRegression
  Bug

  dotnet/aspnetcore#69739 · Filter by author DavidZidar opened on Oct 9, 2026
  2

• Nested wildcard host endpoint is incorrectly selected for a broader host match

  area-routing
  Bug

  dotnet/aspnetcore#69737 · Filter by author cincuranet opened on Oct 9, 2026
  2

  

• OpenAPI: [Obsolete] on a property leaks deprecated: true into the shared component schema

  area-minimalfeature-openapi
  Bug

  dotnet/aspnetcore#69729 · Filter by author sander1095 opened on Oct 8, 2026
  2

• OpenAPI: property-level annotations are emitted inside the oneOf branch for nullable componentized properties

  area-minimalfeature-openapi
  Bug

  dotnet/aspnetcore#69727 · Filter by author sander1095 opened on Oct 8, 2026
  3

• OutputCachePolicyBuilder.With re-evaluates its predicate across policy phases

  area-middleware
  Bug

  dotnet/aspnetcore#69720 · Filter by author cincuranet opened on Oct 8, 2026
  3

• Blazor app returns 404 for _framework/dotnet-browser-tools/hot-reload-settings.json after installing 11.0 RTM

  area-blazorRegression
  Bug

  dotnet/aspnetcore#69718 · Filter by author jinzhao1127 opened on Oct 8, 2026 · Backlog
  4

  

• Form mapping problems still present in 11.0.0-rc.1: file lists in collection items, root IReadOnlyList<IFormFile>, ']' in dictionary keys

  area-blazor
  Bug

  dotnet/aspnetcore#69717 · Filter by author kkdev92 opened on Oct 8, 2026 · Backlog
  1

  

• Http2Connection.ProcessPingFrameAsync should validate PING-ACK payload

  area-networking
  dotnet/aspnetcore#69710 · Filter by author elinor-fung opened on Oct 7, 2026
  2

• Harden ClientCertificateMode config validation

  area-networking
  dotnet/aspnetcore#69707 · Filter by author hoyosjs opened on Oct 7, 2026
  1

• IIS in-process: first request can observe empty IServerAddressesFeature.Addresses before startup publishes bindings

  area-networkingfeature-iis
  Bug

  dotnet/aspnetcore#69704 · Filter by author halter73 opened on Oct 7, 2026
  1

• [Hardening] Cancel pending cookie renewal when principal validation rejects authentication

  area-auth
  dotnet/aspnetcore#69701 · Filter by author rokonec opened on Oct 7, 2026
  1

• OpenIdConnectHandler.SignOutAsync should only use a saved ID token issued by its own scheme

  area-auth
  dotnet/aspnetcore#69695 · Filter by author rokonec opened on Oct 7, 2026
  1

• HTTP/1.1 infinite KeepAliveTimeout and RequestHeadersTimeout expire on the next heartbeat due to deadline overflow

  area-networkingfeature-kestrel
  Bug

  dotnet/aspnetcore#69692 · Filter by author ramazan199 opened on Oct 7, 2026
  1

• WebApplicationFactory sometimes throws ObjectDisposedException instead of the app's startup exception

  area-mvc
  Bug

  dotnet/aspnetcore#69684 · Filter by author Demivan opened on Oct 6, 2026
  2

• DBSC: full support for multiple DBSC schemes, including testing and validation

  area-auth
  dotnet/aspnetcore#69682 · Filter by author rokonec opened on Oct 6, 2026
  1