GoKawiilMicrosoft issues out-of-band .NET fix for critical Brotli decoder flaw
Microsoft has shipped emergency security updates for .NET 8, 9, and 10, plus .NET 11 Release Candidate 3, to fix a critical vulnerability dubbed Broccoli2Shell (CVE-2026-111497). Discovered by Imperva's Red Team, the bug is an out-of-bounds write in the Brotli decompression library that can let attackers crash apps, leak memory, or in some cases execute code remotely via crafted Brotli-compressed data.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw only affects applications that have manually enabled Brotli decompression features such as ASP.NET Core request decompression or HttpClient response decompression, since these are not on by default, which narrows but does not eliminate real-world exposure. Because proof-of-concept exploits are already public on GitHub, security researchers warn the window for attackers to weaponize the bug before organizations patch could be short, even though no active exploitation has been reported yet. Applications bundling their own copy of the Brotli library remain at risk even after the system library is updated, meaning remediation could be more complex than a single patch for some organizations.
- CVE-2026-111497, aka Broccoli2Shell, is a critical out-of-bounds write bug in the Brotli decoder used by .NET.
- Microsoft has released out-of-band patches for .NET 8, 9, 10, and .NET 11 RC3, urging immediate updates.
- Public PoC exploit code exists, but Microsoft and researchers report no confirmed in-the-wild attacks so far.
Source: bleepingcomputer.com, 2026-10-26
Published there as: “Microsoft releases emergency .NET patches for critical Brotli flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.