Microsoft Issues Emergency Patch for .NET Security Flaw

Microsoft has released an emergency security patch for .NET outside of its regular schedule. The patch addresses a buffer overflow vulnerability (a flaw in which a program writes data beyond its allocated memory space) in Brotli, a compression technology developed by Google (CVE-2026-111497). On Sunday, October 25 local time, Microsoft shipped four updates covering .NET 8, 9, and 10, as well as three release candidates (RC, pre-release previews) of .NET 11, and urged users to apply them as soon as possible.

The flaw was discovered by Imperva's Red Team and has been dubbed "Broccoli2Shell," though it is also tracked under the aliases Node2Shell and HTTP2Shell. It stems from an out-of-bounds write in the Brotli decoder, where data is written beyond the intended memory range.

In its vulnerability description, Microsoft said an unauthenticated attacker could read or corrupt process memory, potentially leading to information disclosure, denial of service (DoS), or privilege escalation. The official CVE database entry also notes the possibility of arbitrary code execution using a crafted Brotli compressed stream. The flaw scores 9.2 on the CVSS (Common Vulnerability Scoring System), placing it at the highest severity level.

Microsoft's Security Response Center confirmed that the vulnerability has already been disclosed publicly and is rated critical based on its own analysis, though there is no evidence of exploitation yet. Its exploitability assessment classifies the likelihood of exploitation as "more likely." A proof-of-concept (PoC) exploit for Broccoli2Shell has already been posted on GitHub.

The impact is limited to applications that use code paths processing Brotli-compressed data. According to Microsoft, affected applications include those using ASP.NET Core request decompression, HttpClient automatic response decompression, or the Brotli APIs in System.IO.Compression. These features are disabled by default, so environments where developers have explicitly enabled them are at risk. The .NET Framework is not affected, and the vulnerability impacts .NET 8, 9, 10, and 11 on all operating systems.

However, there are warnings that simply updating the system's Brotli library may not eliminate the risk for applications that bundle their own copy of Brotli. Developers should apply the .NET updates and also review the Brotli configuration within their applications.

How the update is applied depends on the deployment model. According to Microsoft's guidance, framework-dependent applications only need the updated runtime installed and restarted, while self-contained applications must be rebuilt and redeployed. Containers must also be rebuilt with updated images. Installed runtimes can be checked with the dotnet --list-runtimes command.