CriticalCVE
Microsoft releases emergency .NET patches for critical Brotli flaw
BleepingComputer·Source published ·1 min read
What happened?
Microsoft released emergency.NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]
Key details
- Microsoft issued emergency .NET patches for a critical Brotli decoder flaw tracked as CVE-2026-111497.
- The vulnerability is an out-of-bounds write in the Brotli decoder used for Google's lossless compression algorithm.
- Exploitation can cause crashes, memory leaks, and remote code execution on systems with vulnerable Brotli binaries.
- Attackers can also remotely escalate privileges on unpatched .NET installations using non-default configurations.
- Applications processing Brotli data via ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs are affected.
- Brotli decompression is not enabled by default in standard .NET or ASP.NET Core installations.
- Proof-of-concept exploits exist on GitHub, but no malicious exploitation in the wild has been reported.
Affected
- .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 are affected.
Fixes and mitigations
- Block incoming Brotli-compressed requests using a proxy or firewall if updates cannot be applied immediately.
- Disable Brotli decoding until a patch can be applied.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.