Microsoft releases emergency .NET patches for critical Brotli flaw

Key Points:

• Microsoft has released emergency security updates for .NET versions 8 through 11 Release Candidate 3 to patch a critical vulnerability named Broccoli2Shell (CVE-2026-111497) affecting the Brotli decoder used in data compression.
• The flaw, an out-of-bounds write in the Brotli decoder, allows unprivileged attackers to trigger crashes, memory leaks, or potentially remote code execution by sending malicious Brotli-compressed streams.
• This vulnerability impacts HTTP clients, servers, and applications using Brotli decompression in .NET, especially those manually enabling Brotli decompression via ASP.NET Core or HttpClient, as it is not enabled by default.
• Microsoft urges immediate updating to the latest .NET security patches and advises blocking Brotli-compressed requests or disabling Brotli decoding as temporary mitigations for those unable to update promptly.
• Although proof-of-concept exploits exist publicly, no active malicious exploitation has been reported, and updating the system Brotli library alone is insufficient if applications bundle their own Brotli versions.