Apps & Software

Microsoft Issues Emergency .NET Patches for Critical Brotli Flaw

Microsoft has released emergency security updates for .NET to address a critical-severity vulnerability in the Brotli data decoder.

Radwan AbdulhadiEditor and technology writer

Published: October 26, 2026 · Updated: October 26, 2026 · 3 min read

Microsoft Issues Emergency .NET Patches for Critical Brotli Flaw — Image: BleepingComputer

Emergency Security Updates Issued

Microsoft has released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, which is also tracked under the names Node2Shell and HTTP2Shell, as reported by BleepingComputer.

The vulnerability has been officially designated as CVE-2026-111497. According to details released in the official advisory, the flaw originates from an out-of-bounds write within the Brotli decoder.

Discovery and Technical Analysis

The critical security issue was discovered by researchers on the Imperva Red Team. The vulnerability impacts software that expands data compressed via Google's widely utilized Brotli lossless compression algorithm.

When exploited, unprivileged attackers can leverage a maliciously crafted Brotli-compressed stream to provoke application crashes or memory leaks. In certain scenarios, this can result in remote code execution on devices equipped with vulnerable Brotli binaries or libraries.

Attack Vectors and Affected Configurations

Comprehensive technical specifics regarding the vulnerability and mitigation guidance are detailed on the official Microsoft advisory page for the security update.

According to Microsoft said, attackers can leverage this specific flaw to remotely escalate privileges on systems running unpatched .NET installations configured with non-default settings.

Microsoft noted that applications can be impacted if they process Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic response decompression, or through the System.IO.Compression Brotli APIs. However, the company emphasized that Brotli decompression is not enabled by default in standard out-of-the-box .NET or ASP.NET Core installations, meaning applications must manually opt in or explicitly invoke the decompression APIs.

Available Patches and Versions

To counter the vulnerability, Microsoft has made emergency out-of-band updates available for multiple framework versions, including the .NET 8 SDK and Runtime and newer iterations.

Patches have likewise been issued for the .NET 9 SDK and Runtime, along with releases covering the .NET 10 SDK and Runtime and .NET 11 Release Candidate 3.

Mitigation and Outlook

Although proof-of-concept exploits targeting Broccoli2Shell have already been published on GitHub, administrators have not yet reported any instances of malicious exploitation actively occurring in the wild. Industry tracking details are also available via an online portal tracking the flaw.

Security analysts warn that simply updating the system-level Brotli library will not resolve the risk for applications that bundle their own private copy of the library. Administrators who cannot immediately apply the official software updates are advised to block incoming Brotli-compressed requests via a proxy or firewall, or to temporarily disable Brotli decoding until patches can be properly deployed.