Microsoft Issues Emergency .NET Patches for Critical Brotli Flaw
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder; proof-of-concept exploits are public, but no in-the-wild attacks had been reported.
Photo: Atomic Taco / CC BY-SA 2.0 via Wikimedia Commons
Microsoft has released out-of-band security updates for .NET to fix a critical vulnerability in the Brotli decompression code, BleepingComputer reported on October 26. The flaw is tracked as CVE-2026-111497 and has also been nicknamed Broccoli2Shell, Node2Shell and HTTP2Shell. Microsoft's advisory was published the previous Sunday.
The vulnerability
The bug is an out-of-bounds write in the Brotli decoder, the component that expands Brotli-compressed data. A specially crafted data stream can cause crashes or memory leaks and, in some cases, remote code execution. BleepingComputer reported that attackers can also use it to escalate privileges on unpatched .NET installations with non-default configurations. The report did not give a CVSS score.
Fixed versions
- .NET 8: 8.0.33
- .NET 9: 9.0.22
- .NET 10: 10.0.14
- .NET 11: Release Candidate 3
Who is exposed
Microsoft says Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install, in the words quoted by BleepingComputer. Applications are at risk if they process Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the System.IO.Compression Brotli APIs. The flaw affects HTTP clients and servers, and other software that uses vulnerable Brotli implementations.
Exploitation and mitigation
Proof-of-concept exploits have been published on GitHub. No malicious exploitation had been reported when BleepingComputer published its article.
Microsoft advises installing the updates as soon as possible. Organizations that cannot patch immediately can block Brotli-compressed requests at a proxy or firewall, or disable Brotli decoding. Updating the Brotli library on the operating system does not protect applications that bundle their own copy of the library.
Context
Brotli is widely used for web compression, so a decoder bug can reach many products beyond .NET. Administrators should check which of their applications ship their own Brotli code.
