Microsoft has released emergency security updates for a critical Brotli vulnerability affecting .NET applications that explicitly enable decompression. The flaw, tracked as CVE-2026-111497, can allow an unauthorized attacker to elevate privileges over a network, according to Microsoft’s advisory published October 25, 2026.
The exposure depends on how an application handles compressed data. Microsoft says Brotli decompression is disabled by default in standard .NET and ASP.NET Core installations. Applications must enable ASP.NET Core request decompression or HttpClient response decompression, or directly call the Brotli decompression APIs, to use the affected functionality.
Brotli is a lossless compression algorithm developed by Google. The vulnerability involves an out-of-bounds write in its decoder, meaning decompression can write data outside the intended memory boundaries. BleepingComputer reported on October 26 that Imperva Red Team discovered the flaw, also known as Broccoli2Shell, Node2Shell and HTTP2Shell.
According to that report, a specially crafted Brotli-compressed stream can cause crashes or memory leaks and, in some circumstances, remote code execution in software using vulnerable Brotli binaries or libraries. Microsoft classifies the impact on .NET as elevation of privilege and rates the vulnerability Critical. Its assessment indicates that exploitation requires no prior privileges or user interaction, but has high attack complexity.
Updates and exposure
BleepingComputer lists the out-of-band updates as .NET 8.0.33, .NET 9.0.22 and .NET 10.0.14, alongside .NET 11 Release Candidate 3. The report says Microsoft urged users to update as soon as possible.
The distinction between system libraries and application dependencies also matters. A dedicated tracking portal cited by BleepingComputer warns that updating a system’s Brotli library does not fix applications that bundle their own copy. The report advises organizations unable to patch immediately to block incoming Brotli-compressed requests through a proxy or firewall, or disable Brotli decoding until updates can be applied.
At its original publication, Microsoft’s advisory for CVE-2026-111497 marked the vulnerability as publicly disclosed, with no exploitation reported, and assessed exploitation as more likely. BleepingComputer subsequently reported that proof-of-concept exploits had appeared on GitHub, while saying no reports of malicious exploitation in the wild had emerged.
