AzureFeeds

We are pleased to announce the release of Microsoft.Data.SqlClient 7.0.2 and 6.1.6, stable servicing updates now available on NuGet.

Both releases include:

• WAM broker support for supported Microsoft Entra ID authentication modes on Windows


• TDS parsing security hardening with strict data-length bounds checks


• Key bug fixes, including a SqlDataReader null-reference path and an Always Encrypted signature verification cache fix

Install or update from NuGet:

dotnet add package Microsoft.Data.SqlClient –version 7.0.2 or dotnet add package Microsoft.Data.SqlClient –version 6.1.6

Full release notes:

• 7.0.2: https://github.com/dotnet/SqlClient/releases/tag/v7.0.2


• 6.1.6: https://github.com/dotnet/SqlClient/releases/tag/v6.1.6

What’s in these releases

WAM broker support for supported Entra ID authentication modes (Windows)

Both servicing releases add support for the Web Account Manager (WAM) broker in supported Entra ID authentication flows on Windows. This enables OS-brokered token handling, better single sign-on behavior with the signed-in Windows account, and improved support for Conditional Access and Windows Hello scenarios.

For application code, this is exposed through ActiveDirectoryAuthenticationProviderOptions, including the UseWamBroker property.

Hardened TDS token parsing

The TDS parser now validates declared token data lengths against the available input buffer before reading. This improves resilience against malformed or hostile protocol payloads and helps prevent out-of-bounds token parsing behavior.

For well-formed SQL Server responses, behavior is unchanged.

SqlDataReader null-reference fix

These releases include a fix for a SqlDataReader null-reference path in buffer-based reads. Calls that previously could fail with NullReferenceException now correctly surface argument validation errors.

Always Encrypted signature-cache fix

The Always Encrypted column master key signature verification cache logic was corrected so cached verification results are read and applied using the correct key and value. This prevents stale or mismatched cache outcomes from being treated as valid signature verification results.

Additional note for 7.0.2 users

Starting with version 7.0.2, Microsoft.Data.SqlClient and companion extension packages are version-aligned to 7.0.2. If your application references extension packages (for example Microsoft.Data.SqlClient.Extensions.Azure), upgrade them to the same version for compatibility.

Getting started

If you are new to Microsoft.Data.SqlClient, check out the introduction documentation: https://learn.microsoft.com/sql/connect/ado-net/introduction-microsoft-data-sqlclient-namespace

For users of System.Data.SqlClient, see the porting cheat sheet: https://github.com/dotnet/SqlClient/blob/main/porting-cheat-sheet.md

If you encounter any issues, please report them on GitHub: https://github.com/dotnet/SqlClient/issues