Microsoft issues emergency .NET patches for critical Brotli flaw

Microsoft has released emergency security updates for a critical vulnerability in the Brotli decoder, tracked as CVE-2026-111497 and known as Broccoli2Shell, Node2Shell, and HTTP2Shell. Imperva Red Team found the flaw, which involves an out-of-bounds write.

A maliciously crafted Brotli-compressed stream could let an unprivileged attacker cause crashes or memory leaks and, in some cases, achieve remote code execution on devices with vulnerable Brotli binaries or libraries. Microsoft also says attackers could remotely escalate privileges on systems with unpatched .NET installations using non-default configurations.

Microsoft said applications may be affected when they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Brotli decompression is not enabled by default in .NET or ASP.NET Core; applications must opt in to the relevant features or invoke the APIs.

The out-of-band updates cover .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft advised users to update as soon as possible. Proof-of-concept exploits have been published on GitHub, but no malicious exploitation in the wild has been reported. Updating the system Brotli library may not protect apps that bundle their own copy. The source says users unable to apply updates immediately can block incoming Brotli-compressed requests with a proxy or firewall, or disable Brotli decoding until they can patch.