Microsoft.Data.SqlClient

The current data provider for SQL Server and Azure SQL databases. This has replaced System.Data.SqlClient. These classes provide access to SQL and encapsulate database-specific protocols, including tabular data stream (TDS). Commonly Used Types: Microsoft.Data.SqlClient.SqlConnection Microsoft.Data.SqlClient.SqlException Microsoft.Data.SqlClient.SqlParameter Microsoft.Data.SqlClient.SqlDataReader Microsoft.Data.SqlClient.SqlCommand Microsoft.Data.SqlClient.SqlTransaction Microsoft.Data.SqlClient.SqlParameterCollection Microsoft.Data.SqlClient.SqlClientFactory When using NuGet 3.x this package requires at least version 3.4.

View on Nuget

Activity

Latest release: 3d ago
Total releases: 109
Cadence: ~11 days
Last 12 months: 21

Details

License: MIT
First release: May 06, 2019

Releases

Version	Released
`7.0.3` patch	Sep 10, 2026
`6.1.7` patch	Sep 10, 2026
`7.1.0-preview3.26238.4` pre	Aug 27, 2026
`7.1.0-preview2.26190.5` pre	Jul 10, 2026
`7.0.2` patch	Jun 25, 2026
`6.1.6` patch	Jun 25, 2026
`7.1.0-preview1.26124.5` pre	May 05, 2026
`6.1.5` patch	Apr 27, 2026
`7.0.1` patch	Apr 24, 2026
`7.0.0` major	Mar 17, 2026
`7.0.0-preview4.26064.3` pre	Mar 05, 2026
`6.0.5` patch	Jan 16, 2026
`6.1.4` patch	Jan 15, 2026
`5.1.9` patch	Jan 13, 2026
`7.0.0-preview3.25342.7` pre	Dec 08, 2025
`6.0.4` patch	Nov 15, 2025
`5.1.8` patch	Nov 14, 2025
`6.1.3` patch	Nov 12, 2025
`7.0.0-preview2.25289.6` pre	Oct 16, 2025
`6.1.2` patch	Oct 08, 2025
`6.0.3` patch	Oct 08, 2025
`7.0.0-preview1.25257.1` pre	Sep 14, 2025
`6.1.1` minor	Aug 14, 2025
`6.1.0-preview2.25178.5` pre	Jun 27, 2025
`6.1.0-preview1.25120.4` pre	Apr 30, 2025
`5.2.3` patch	Apr 29, 2025
`6.0.2` patch	Apr 25, 2025
`5.1.7` patch	Apr 25, 2025
`6.0.1` major	Jan 23, 2025
`6.0.0-preview3.24332.3` pre	Nov 28, 2024
`6.0.0-preview2.24304.8` pre	Oct 30, 2024
`6.0.0-preview1.24240.8` pre	Aug 27, 2024
`5.2.2` patch	Aug 27, 2024
`5.1.6` patch	Aug 27, 2024
`4.0.6` patch	Aug 21, 2024
`3.1.7` patch	Aug 21, 2024
`5.2.1` patch	May 31, 2024
`5.2.0` minor	Feb 28, 2024
`5.1.5` patch	Jan 29, 2024
`5.2.0-preview5.24024.3` pre	Jan 25, 2024
`5.1.4` patch	Jan 09, 2024
`5.1.3` patch	Jan 09, 2024
`4.0.5` patch	Jan 09, 2024
`3.1.5` patch	Jan 09, 2024
`2.1.7` patch	Jan 09, 2024
`5.2.0-preview4.23342.2` pre	Dec 08, 2023
`3.1.4` patch 1 CVE	Oct 31, 2023
`4.0.4` patch 1 CVE	Oct 30, 2023
`5.1.2` patch 1 CVE	Oct 26, 2023
`5.2.0-preview3.23201.1` pre	Jul 20, 2023

1–50 of 109

Dependencies (19)

Depends on

7.0.3

Used by

4001

Supply-chain exposure

4,001 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2024-0056 GHSA-98g6-xh36-x2p7 BIT-dotnet-2024-0056 BIT-dotnet-sdk-2024-0056 Jan 09, 2024

Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

8.7 / 10
High
Network High None None Changed High High None

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Affected versions

1.0.19123.2-Preview1.0.19128.1-Preview1.0.19189.1-Preview1.0.19221.1-Preview1.0.19239.11.0.19249.11.0.19269.11.1.01.1.11.1.21.1.31.1.4

+ 27 more Show less

2.0.02.0.12.1.02.1.12.1.22.1.32.1.42.1.52.1.63.0.03.0.13.1.03.1.13.1.23.1.33.1.44.0.04.0.14.0.24.0.34.0.45.0.05.0.15.0.25.1.05.1.15.1.2

Fixed in

2.1.73.1.54.0.55.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2024-0056
https://github.com/dotnet/announcements/issues/292
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056

Updated May 31, 2024 · Source: OSV.dev
CVE-2022-41064 GHSA-8g2p-5pqh-5jmc Nov 08, 2022

.NET Information Disclosure Vulnerability

5.8 / 10
Medium
Adjacent High Low None Changed High None None

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages.

A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.

Mitigation factors

If you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability.

How do I know if I am affected?

.NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package.

For example, the Microsoft.AspNetCore.Mvc package depends on the Microsoft.AspNetCore.Mvc.Core package. When you add a dependency on Microsoft.AspNetCore.Mvc in your project, you're taking a transitive dependency on Microsoft.AspNetCore.Mvc.Core.

Any application that has a direct or transitive dependency on the  affected packages listed above are vulnerable.

How do I fix the issue?

If you are using System.Data.SqlClient on .NET Framework you must install the November update for .NET Framework

If you are using System.Data.SqlClient on .NET Core, .NET 5 or .NET 6 you must update the nuget package to an updated version as listed in the affected packages.

If you are using Microsoft.Data.SqlClient, anywhere (.NET Core, .NET 5/6, .NET Framework) and you are using a version that is vulnerable you must update as listed in the affected packages.

Additional Details

.NET and .NET Framework projects have two types of dependencies: direct and transitive. You must update your projects using the following instructions to address both types of dependency.

Additionally, .NET Framework users must also install the November 2022 security patch to be protected.

Direct dependencies

Direct dependencies are discoverable by examining your csproj file. They can be fixed by editing the project file or using nuget command line to update the dependency.

Transitive dependencies

Transitive dependencies occur when you add a package to your project that in turn relies on another package. Transitive dependencies can be discovered by searching the project.assets.json file for each of your projects. This file is produced on each build and is in the obj directory for each project.

The project.assets.json files are the authoritative list of all packages used by your project, containing both direct and transitive dependencies.

Fixing direct dependencies

Direct dependencies are nuget packages that have been specifically added to a project, rather than being pulled in because a nuget package added requires it. They can be seen in the solution explorer in Visual Studio or by opening the csproj for the project and examining the packageReference nodes for the package name, specified by the Include parameter, and its version, specified by the Version parameter.

For example, the following project file has a direct dependency on version 2.1.1 of Microsoft.Data.SqlClient.

<Project Sdk="Microsoft.NET.Sdk.Web"> <PropertyGroup> <TargetFramework>net6.0</TargetFramework> <Nullable>enable</Nullable> <ImplicitUsings>enable</ImplicitUsings> </PropertyGroup> <ItemGroup> <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.1" /> </ItemGroup> </Project>

Fixing direct dependencies with the nuget command line

Open a command line to the directory holding your project

Run the following command if you are using a version of Microsoft.Data.SqlClient between 2.0.0 and 2.1.1

dotnet add package Microsoft.Data.SqlClient --version 2.1.2

Run the following command if you are using a version of Microsoft.Data.SqlClient below 1.1.4

dotnet add package Microsoft.Data.SqlClient --version 1.1.4

Run the following command if you are using a version of System.Data.SqlClient below 4.8.4

dotnet add package System.Data.SqlClient --version 4.8.5

Fixing direct dependencies by editing the project file

Open projectname.csproj in your editor. If you're using Visual Studio, right-click the project and choose Edit projectname.csproj from the context menu, where projectname is the name of your project.

Look for PackageReference elements. The following shows an example project file:

<Project Sdk="Microsoft.NET.Sdk.Web"> <PropertyGroup> <TargetFramework>net6.0</TargetFramework> <Nullable>enable</Nullable> <ImplicitUsings>enable</ImplicitUsings> </PropertyGroup> <ItemGroup> <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.1" /> </ItemGroup> </Project>

The preceding example has a reference tone of the vulnerable packages as seen by the single PackageReference element. The name of the package is in the Include attribute. The package version number is in the Version attribute.

To update the version to the secure package, change the version number to the updated package version as listed in the Affected software section of this document.

In this example, update Microsoft.Data.SqlClient to the appropriate fixed version for your major version. Save the csproj file. The example csproj now looks as follows:

<Project Sdk="Microsoft.NET.Sdk.Web"> <PropertyGroup> <TargetFramework>net6.0</TargetFramework> <Nullable>enable</Nullable> <ImplicitUsings>enable</ImplicitUsings> </PropertyGroup> <ItemGroup> <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.2" /> </ItemGroup> </Project>

If you're using Visual Studio and you save your updated csproj file, Visual Studio will restore the new package version.

You can see the restore results by opening the Output window (Ctrl+Alt+O) and changing the Show output from drop-down list to Package Manager.

If you're not using Visual Studio, open a command line and change to your project directory. Execute the dotnet restore command to restore the updated dependencies.

Now recompile your application. If after recompilation you see a Dependency conflict warning, you must update your other direct dependencies to versions that take a dependency on the updated package.

Discovering and fixing transitive dependencies

Rebuild your solution and then open the project.assets.json file from in each of your project’s obj directory in your editor. We suggest you use an editor that understands JSON and allows you to collapse and expand nodes to review this file. Both Visual Studio and Visual Studio Code provide JSON friendly editing.

Search the project.assets.json file for the vulnerable packages above using the format packagename/ for each of the package names from the preceding table. If you find the assembly name in your search:

Examine the line on which they are found, the version number is after the /.

Compare to the vulnerable versions

For example, a search result that shows "Microsoft.Data.SqlClient": "2.1.0" is a reference to version 2.1.0 of Microsoft.Data.SqlClient If your project.assets.json file includes vulnerable versions of the nuget packages then you need to fix the transitive dependencies.

If you have not found any reference to any vulnerable packages, this means either

None of your direct dependencies depend on any vulnerable packages, or

You have already fixed the problem by updating the direct dependencies.

If your transitive dependency review found references to the vulnerable package, you must add a direct dependency to the updated package to your csproj file to override the transitive dependency.

Editing projects to fix transitive dependencies

Open projectname.csproj in your editor. Look for PackageReference nodes, for example:

<Project Sdk="Microsoft.NET.Sdk.Web"> <PropertyGroup> <TargetFramework>net6.0</TargetFramework> <Nullable>enable</Nullable> <ImplicitUsings>enable</ImplicitUsings> </PropertyGroup> <ItemGroup> <PackageReference Include="IndirectDependency" Version="1.0.0" /> </ItemGroup> </Project>

You must add a direct dependency to the updated, matching major/minor version of the vulnerable by adding it to the csproj file. This is done by adding a new line to the dependencies section, referencing the fixed version. For example,

<Project Sdk="Microsoft.NET.Sdk.Web"> <PropertyGroup> <TargetFramework>net6.0</TargetFramework> <Nullable>enable</Nullable> <ImplicitUsings>enable</ImplicitUsings> </PropertyGroup> <ItemGroup> <PackageReference Include="IndirectDependency" Version="1.0.0" /> <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.2" /> </ItemGroup> </Project>

After you've added the direct dependency reference, save your csproj file.

If you're using Visual Studio, save your updated csproj file and Visual Studio will restore the new package versions. You can see the restore results by opening the Output window (Ctrl+Alt+O) and changing the Show output from drop-down list to Package Manager.

If you're not using Visual Studio, open a command line and change to your project directory. Execute the dotnet restore command to restore the new dependencies.

Using the nuget command line to fix transitive dependencies

Open a command window and change directory to your project directory.

Run the following command if you have an indirect dependency on Microsoft.Data.SqlClient between versions 2.0.0 and 2.1.1

dotnet add package Microsoft.Data.SqlClient --version 2.1.2

Run the following command if you have an indirect dependency on Microsoft.Data.SqlClient below 1.1.4

dotnet add package Microsoft.Data.SqlClient --version 1.1.4

Run the following command if you have an indirect dependency on System.Data.SqlClient below 4.8.4

dotnet add package System.Data.SqlClient --version 4.8.5

Execute the dotnet restore command to restore the new dependencies.

Rebuilding your application

Finally, you must rebuild your application, test, and redeploy.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

V1.0 (November 8, 2022): Advisory published.

Version 1.0

Last Updated 2022-11-08

Affected versions

1.0.19123.2-Preview1.0.19128.1-Preview1.0.19189.1-Preview1.0.19221.1-Preview1.0.19239.11.0.19249.11.0.19269.11.1.01.1.11.1.21.1.32.0.0

+ 3 more Show less

2.0.12.1.02.1.1

Fixed in

1.1.42.1.2

References

https://github.com/dotnet/corefx/security/advisories/GHSA-8g2p-5pqh-5jmc
https://nvd.nist.gov/vuln/detail/CVE-2022-41064
https://github.com/dotnet/runtime/issues/78042
https://github.com/dotnet/corefx
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41064
https://www.nuget.org/packages/Microsoft.Data.SqlClient

Updated Dec 03, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 7
patch 55
pre 40

109 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More