Microsoft ships emergency .NET patches for critical Brotli flaw
Original title: Microsoft releases emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
Microsoft issued out-of-band updates for a critical out-of-bounds write in the Brotli decoder, tracked as CVE-2026-111497 and nicknamed Broccoli2Shell. Imperva Red Team found the flaw. Applications are affected only if they opt into ASP.NET Core or HttpClient decompression or call .NET Brotli APIs. Proof-of-concept exploits are on GitHub, and Microsoft reports no malicious exploitation.
Unconfirmed: No malicious exploitation has been reported; privilege escalation is described only for non-default configurations.
- Fixed builds are .NET 8.0.33, 9.0.22, and 10.0.14, plus .NET 11 Release Candidate 3.
- Crafted Brotli streams can crash systems, leak memory, or sometimes run code.
- Remote privilege escalation applies to non-default unpatched .NET configurations.
- Patching the system Brotli library does not fix apps that bundle their own copy.
Impact: Crashes, memory leaks, remote code execution, or privilege escalation
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft .NET 8 | — | 8.0.33 |
| Microsoft .NET 9 | — | 9.0.22 |
| Microsoft .NET 10 | — | 10.0.14 |
| Microsoft .NET 11 | Release Candidate 3 | — |
- 1.Install .NET 8.0.33, 9.0.22, or 10.0.14, or the .NET 11 Release Candidate 3 update.
- 2.If patching must wait, block incoming Brotli-compressed requests or disable Brotli decoding.
- 3.Update apps that bundle their own Brotli library, not only the system copy.
- CVEs
- CVE-2026-111497
- Vendors
- Microsoft
- Products
- .NETASP.NET Core
- Organizations
- Imperva
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at bleepingcomputer.com
Microsoft released emergency . NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.