Microsoft released emergency security updates on October 26 to address the critical .NET Brotli flaw. The vulnerability threatens applications that process specially crafted Brotli-compressed data, potentially causing crashes, memory leaks or remote code execution.
The issue, tracked as CVE-2026-111497, also carries the names Broccoli2Shell, Node2Shell and HTTP2Shell. However, exposure depends on application settings because standard .NET and ASP.NET Core installations do not automatically enable Brotli decompression.
How the .NET Brotli Flaw Affects Applications
The vulnerability involves an out-of-bounds write in the Brotli decoder, which expands data compressed with Google’s lossless compression algorithm. Attackers can exploit this memory-handling error by supplying a malicious compressed stream to vulnerable software.
As a result, the issue reaches beyond individual websites or services. HTTP clients, servers and other applications can face exposure when they rely on affected Brotli implementations.
Successful attacks could crash software or leak memory contents. In some cases, attackers could also execute code remotely. Additionally, Microsoft warns of potential remote privilege escalation on unpatched .NET installations that use non-default configurations.
Applications may encounter the vulnerable functionality through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. However, developers must explicitly enable these features or invoke the APIs themselves.
Microsoft Releases Fixes for Four .NET Versions
Microsoft has issued out-of-band updates for .NET 8, .NET 9 and .NET 10. Meanwhile, .NET 11 Release Candidate 3 includes the corresponding fix for that development release.
The updates addressing the vulnerability are:
| .NET version | Fixed release |
|---|---|
| .NET 8 | 8.0.33 |
| .NET 9 | 9.0.22 |
| .NET 10 | 10.0.14 |
| .NET 11 | Release Candidate 3 |
Microsoft urges users to install the updates as soon as possible. Administrators should therefore identify applications that decompress incoming requests, automatically decode HTTP responses or directly process Brotli data.
Public Exploit Code Increases Patching Urgency
Proof-of-concept exploits have already appeared on GitHub, increasing the urgency of addressing the .NET Brotli flaw. Nevertheless, no reports of malicious exploitation in the wild had emerged at the time of the report.
Updating a system-wide Brotli library does not necessarily protect every application. Some programs bundle their own library copy, meaning administrators must also address those separately packaged components.
If immediate patching is impossible, organisations can temporarily block incoming Brotli-compressed requests through a proxy or firewall. Alternatively, they can disable Brotli decoding until they install the updates. These measures reduce exposure while teams prepare the necessary fixes.
0 responses to “.NET Brotli Flaw Prompts Emergency Microsoft Updates”