Microsoft releases emergency .NET patches for critical Brotli flaw
Summary
Microsoft released emergency .NET updates for critical Brotli flaw CVE-2026-111497. Public PoC exploits exist, but no malicious exploitation in the wild has been reported.
Key points
- The out-of-bounds write in the Brotli decoder is tracked as CVE-2026-111497, Broccoli2Shell, Node2Shell, and HTTP2Shell.
- A crafted Brotli-compressed stream can cause crashes or memory leaks and, in some cases, remote code execution.
- Microsoft says affected .NET applications must use Brotli decompression features; these are not enabled by default in standard .NET or ASP.NET Core installations.
- Microsoft released out-of-band updates for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3, and advises updating promptly.
- PoC exploits have been published, but no malicious exploitation in the wild has been reported.
- Applications bundling their own Brotli library may remain vulnerable after the system Brotli library is updated; Microsoft recommends blocking incoming Brotli-compressed requests or disabling Brotli decoding if updates cannot be applied.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Severity
- Critical
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Block incoming Brotli-compressed requests using a proxy or firewall.
- Disable Brotli decoding until a patch can be applied.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationMicrosoft said attackers could remotely escalate privileges on systems with unpatched .NET installations using non-default configurations.T1210 · Exploitation of Remote ServicesThe flaw can be remotely exploited with a maliciously crafted Brotli-compressed stream against vulnerable applications using Brotli implementations.