KB5097150 Updates .NET 9.0 to 9.0.17 with Security Fixes for Runtime and ASP.NET Core

Microsoft released KB5097150 on June 9, 2026, updating .NET 9.0 to version 9.0.17. Per Microsoft's support article, this is a servicing upgrade, meaning it replaces the previous .NET 9.0 version on the system automatically.

The update fixes three CVEs. CVE-2026-26918 is a critical remote code execution vulnerability in the .NET runtime's deserialization components with a CVSS score of 9.8. It affects applications using BinaryFormatter, DataContractSerializer, and other serialization mechanisms. CVE-2026-26919 is a high-severity denial of service flaw (CVSS 7.5) in ASP.NET Core's Kestrel request processing pipeline. CVE-2026-26920 is a medium-severity information disclosure issue (CVSS 6.5) in System.Security.Cryptography's certificate validation.

The update also includes stability improvements to System.Text.Json for handling malformed JSON payloads, reducing the risk of memory corruption during parsing.

Deserialization vulnerabilities remain one of the most dangerous attack surfaces in .NET applications. CVE-2026-26918 scores CVSS 9.8 because it allows attackers to execute arbitrary code by providing crafted serialized data to any application that processes untrusted input through .NET serializers.

The cross-platform impact makes this update urgent for more than just Windows shops. Linux-based containers running ASP.NET Core, macOS development environments, and Azure App Services all need updating. The .NET 9.0 runtime powers web APIs, microservices, background workers, and desktop apps across all three platforms.

The ASP.NET Core DoS flaw (CVE-2026-26919) is also notable for production environments. Malformed HTTP requests with specific header patterns could exhaust server resources, taking down public-facing web applications without any authentication required.

KB5097150 applies to .NET 9.0 runtime versions 9.0.0 through 9.0.16, ASP.NET Core 9.0, and .NET 9.0 SDK. The update targets all supported platforms: Windows (10 version 1607+, 11, Server 2019/2022/2025), Linux (Ubuntu 20.04+, RHEL 8+, SUSE 15+, Debian 11+), and macOS 12.0 or later.

The June 2026 Patch Tuesday also included parallel updates for .NET 8.0 (KB5097149, updating to 8.0.28) and .NET 10.0 (KB5097148, updating to 10.0.9), per the ManageEngine Patch Tuesday tracking page. Organizations running multiple .NET versions should update all of them.

Containerized deployments need updated base images. Microsoft published mcr.microsoft.com/dotnet/runtime:9.0.17 and mcr.microsoft.com/dotnet/aspnet:9.0.17 on the release date.

KB5097150 is available through Windows Update for client operating systems and WSUS/Microsoft Update Catalog for servers. Per Microsoft's support article, .NET servicing updates are upgrades: installing 9.0.17 automatically removes the previous 9.0 version.

For Linux and macOS, update through package managers:

Ubuntu/Debian: sudo apt update && sudo apt upgrade dotnet-runtime-9.0 RHEL/Fedora: sudo dnf update dotnet-runtime-9.0

For containerized deployments, update Dockerfile base images to the 9.0.17 tags.

Applications must be restarted after installation. Microsoft recommends exiting all .NET-based applications before applying the update. No system restart is required, but running applications won't pick up the fixes until they're restarted.

Enterprise environments can deploy through WSUS, SCCM, Intune, or Azure Update Manager.

The Anavem KB article for KB5097150 documents several known post-update issues. Applications using legacy BinaryFormatter serialization may encounter compatibility problems due to enhanced security validation. Microsoft provides a temporary environment variable as a workaround while migrating code.

ASP.NET Core apps may hit HTTP 413 errors if they process very large requests, as the security fix tightens default request size limits in Kestrel. This can be resolved by configuring appropriate limits in appsettings.json.

Applications using custom certificate validation should be tested, as CVE-2026-26920's fix strengthens TLS certificate chain validation logic. Self-signed certificates and custom CAs may be affected.

The June 2026 Patch Tuesday was one of the largest releases, with 206 CVEs across Microsoft's product portfolio per Talos Intelligence. Organizations should prioritize the .NET updates alongside their Windows patching.