When was the .NET 8 runtime version 8.0.21 rolled out to AWS Lambda for security vulnerability- CVE-2025-55315?

Question

I’m trying to understand the rollout timeline of the .NET 8 managed runtime in AWS Lambda.
**Note: Lambda function has Auto set in runtime configuration **

On these dates, I observed different runtime versions:
 
13 Nov 2025: Redeploying lambda function using the Amazon Toolkit still showed 8.0.20
17 Nov 2025: Creating a new Lambda directly from the console in same region showed 8.0.21
18 Nov 2025: Redeploying the same function which was previously deployed using toolkit but this time using the Amazon console showed 8.0.21

My questions are:
 
1. On what exact date was .NET 8 runtime version 8.0.21 released/rolled out for AWS Lambda?
2. Is region-wise gradual rollout expected for Lambda runtime updates?
3. Does AWS delay a runtime patch if the associated CVE/security vulnerability does not affect the Lambda execution environment?
4. As per observation on diff dates, 8.0.21 was patched on window 13-17 ?
5. Will CVE-2025-55315 wont affect AWS lambda function built on .net core  in AWS ecosystem ? Was that reason for delayed rollout ?

Shahed Kazi (@shajam) · Answer

Take a look at lambda history - https://docs.aws.amazon.com/lambda/latest/dg/lambda-releases.html - it has some details around release time but not to the level you are after.

re:Post Agent · Answer

Based on the provided sources, I can address some aspects of your questions about the .NET 8 runtime version rollout in AWS Lambda.

According to the AWS Elastic Beanstalk platform update documentation, .NET 8.0.21 was included in the Windows Server platform update released on October 23, 2025. Later, this was updated to .NET 8.0.22 in the November 19, 2025 release.

However, the sources don't provide specific information about the exact date when .NET 8.0.21 was rolled out specifically for AWS Lambda, nor do they mention CVE-2025-55315. There's no information in the provided sources about region-wise gradual rollouts for Lambda runtime updates or whether AWS delays runtime patches based on CVE impact assessments.

For Lambda functions with the runtime management configuration set to "Auto," Lambda automatically applies runtime updates to functions when they become available. If you need more control over when runtime updates are applied, you can use the "Manual" runtime update mode, which allows you to explicitly specify which runtime version your function should use.

The sources don't provide information about the specific CVE you mentioned (CVE-2025-55315) or whether it affects .NET Core in the AWS Lambda execution environment.  
**Sources**  
[Release: Elastic Beanstalk Windows Server platform update on October 23, 2025 - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2025-10-23-windows.html)  
[Release: Elastic Beanstalk Windows Server platform update on November 19, 2025 - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2025-11-19-windows.html)  
[Troubleshoot Lambda function runtime version errors | AWS re:Post](https://repost.aws/knowledge-center/lambda-runtime-version-error)

When was the .NET 8 runtime version 8.0.21 rolled out to AWS Lambda for security vulnerability- CVE-2025-55315?

Add your answer

Relevant content