Skip to content

Vulnerabilities & Patches

Microsoft ships emergency out-of-band .NET patches for critical Brotli flaw

The patches fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder with a CVSS score of 9.2 indicating critical severity.

By · 2 min read

https://breach-signal.com/vulnerabilities/microsoft-emergency-dotnet-patches-critical-brotli-flaw/

Share

Microsoft released emergency out-of-band security updates on Oct. 25, 2026, for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3, addressing the critical Brotli decoder flaw tracked as CVE-2026-111497 across all operating systems.

Microsoft reissued fixes for CVE-2026-70197 (memory corruption, .NET 8–11) and CVE-2026-102870 (code injection, .NET 10 and 11) from its Oct. 13, 2026 Patch Tuesday, which were not fully addressed initially. The vendor also patched CVE-2026-114148, a local privilege escalation flaw affecting .NET 7, 8, 9, 10 and 11 on Linux systems because of unsafe ownership metadata in source-build tarballs.

CVE-2026-111497, also called Broccoli2Shell, Node2Shell or HTTP2Shell, is a critical out-of-bounds write vulnerability in the Brotli decoder used by .NET. Brotli is a lossless compression algorithm developed by Google in 2015 and widely used in HTTP clients, servers and applications. Exploiting it lets unauthenticated attackers trigger crashes, memory leaks or remote code execution with maliciously crafted Brotli-compressed streams. The flaw carries a CVSS score of 9.2, indicating critical severity.

Affected applications include those using ASP.NET Core request decompression, HttpClient automatic response decompression or System.IO.Compression Brotli APIs. Brotli decompression is not enabled by default in standard .NET or ASP.NET Core installations.

Proof-of-concept exploits for CVE-2026-111497 appear on GitHub, but no reports of active malicious exploitation in the wild have been confirmed. Microsoft advises blocking incoming Brotli-compressed requests through a proxy or firewall as a temporary mitigation until patches are applied. Updating the system Brotli library does not mitigate risk for applications that bundle their own Brotli library.

Google Brotli versions 1.0.3 through 1.2.0 are also vulnerable, and users must update to the latest version. Microsoft advises developers to update runtimes, rebuild applications and redeploy containers with updated .NET images.

Brotli was designed by two engineers at Google in 2015 to allow developers to speed up algorithm compression for developers.

Infosecurity Magazine (citing Microsoft), Infosecurity Magazine
Tags: , ,

Was this helpful?

Join the discussion

Please read our Comment Policy before commenting. First-time comments are held for moderation. By posting a comment you agree to our Terms of Use and Privacy Policy, which explain how your name, email address and comment are used.

Your email address will not be published. Required fields are marked *

Most read

  1. Attackers exploit four Plex flaws to deploy miner and proxy malware
  2. Democratic lawmakers warn of Russian influence campaign targeting Party ahead of midterms
  3. CERT-EU warns of critical PHP flaws CVE-2026-109618 and CVE-2026-109619
  4. Threat actors exploit Plex2Shell within one day of PoC release
  5. PHP warns of unpatched RCE two days after emergency PHP2Shell patches