Microsoft.Data.SqlClient 7.1.2, 7.0.4, and 6.1.8 are now available

We shipped servicing releases for all three supported SqlClient lines: 7.1.2, 7.0.4 and 6.1.8. They pick up a dependency security fix, tighten certificate validation, and fix several bugs.

Check your HostNameInCertificate values

HostNameInCertificate tells SqlClient which name to expect in the server's TLS certificate. You use it when the name you connect to isn't the name on the certificate, for example when you connect by IP address, through an alias, or through a load balancer:

var connectionString =
    "Server=10.0.0.20;Database=Sales;" +
    "Encrypt=Mandatory;HostNameInCertificate=sql01.contoso.com;" +
    "Integrated Security=true";

In earlier versions, SqlClient used HostNameInCertificate only when the server name in Data Source didn't match the certificate. If the server name matched, a wrong HostNameInCertificate was ignored and the connection opened.

Starting with these releases, a HostNameInCertificate value replaces the server name for certificate validation. If the value isn't in the certificate, the connection fails, even when the server name matches.

We tested this against Azure SQL Database and SQL database in Fabric with a deliberately incorrect value for HostNameInCertificate:

In 6.1.8, the stricter check applies only to managed networking. Managed networking is the default on Linux and macOS. On Windows you opt in to it.

To check your applications, search your connection strings and configuration for HostNameInCertificate. For each value, confirm the name appears in the server certificate's subject or subject alternative names. If it doesn't, fix the value or remove it. A wrong value now fails with a certificate name mismatch error during the TLS handshake, before login.

Security updates

All three releases raise dependency minimums to address CVE-2026-84008. System.Security.Cryptography.Pkcs moves to 8.0.2 on .NET Framework, .NET 8, and .NET Standard 2.0. On .NET 9, the Microsoft.Extensions and System packages move to 9.0.21.

If your project references any of those packages directly, raise those references to at least the same versions.

The releases also isolate Always Encrypted enclave sessions by attestation protocol. A connection that asks for one attestation protocol no longer reuses a cached enclave session created with a different one.

Clearer errors for Entra sign-in on windowless hosts

Active Directory Interactive authentication on Windows uses the Web Account Manager (WAM) broker, and WAM needs a parent window. A host with no window, such as an Azure Functions local worker or a Windows service, used to fail with a bare MSAL window_handle_required error.

The error message now tells you what to do instead:

• If your app has a window, pass its handle with SetParentActivityOrWindowFunc.
• If your host has no window, use Active Directory Default with a non-interactive credential, such as a managed identity or environment credential.
• To sign in interactively without WAM, set your own ApplicationClientId and turn off UseWamBroker.

This guidance is in Microsoft.Data.SqlClient.Extensions.Azure 7.1.2 and 7.0.4, and in Microsoft.Data.SqlClient 6.1.8.

Bug fixes

These fixes apply to all three releases unless noted:

• SqlDataReader.HasRows returned false for a result set that had rows when several informational messages, such as PRINT output, arrived before the first row.
• Statistics bookkeeping could throw InvalidOperationException with "Nullable object must have a value." In 6.1, this was a regression starting with 6.1.4 that showed up on MARS connections.
• A malformed PRELOGIN response from a server or proxy threw IndexOutOfRangeException from Open. It now fails with the corrupted-stream error, and malformed row and authentication responses close the physical connection so it can't return to the pool. (7.1.2 and 7.0.4)
• Closing a managed networking connection while MARS was still receiving could raise unobserved task exceptions. (7.1.2 and 7.0.4)
• On Linux and macOS, SqlClient no longer tries to load the Windows native networking library, which could throw DllNotFoundException. (7.1.2)
• Entra authentication now works when the server returns an authority URL with an OAuth endpoint suffix, such as /oauth2/authorize. Dataverse and Dynamics 365 return this form. (6.1.8)

Upgrade

Install the release for your line:

dotnet add package Microsoft.Data.SqlClient --version 7.1.2
dotnet add package Microsoft.Data.SqlClient --version 7.0.4
dotnet add package Microsoft.Data.SqlClient --version 6.1.8

In 7.0 and 7.1, the companion packages ship with the same version number. If you reference them, update them to the same version as the driver:

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

Upgrading from 7.1.1 or 7.0.3 doesn't need new .NET Framework binding redirects.

Read the full release notes for 7.1.2, 7.0.4, and 6.1.8.

For more about certificate validation, see Encryption and certificate validation