Microsoft releases emergency .NET patches for Brotli flaw
The updates fix CVE‑2026‑111497, a buffer‑overflow flaw that could let attackers read or corrupt memory in vulnerable applications using the Brotli compression library.
27 Oct 2026 0 reads Compiled with AI
Microsoft released out‑of‑band security updates for .NET, Visual Studio and PowerShell on Sunday to fix CVE‑2026‑111497, a buffer‑overflow flaw discovered by OpenAI’s Codex Security team while testing the Brotli decoder. The flaw, also known as Node2Shell, HTTP2Shell and Broccoli2Shell, can let an unauthenticated attacker read or corrupt memory in vulnerable applications, and in some cases could lead to remote code execution.
The flaw originates from an out‑of‑bounds write in the Brotli decoder that processes data compressed with the library. It affects Brotli versions 1.0.3 through 1.2.0; the updated releases 1.0.10, 1.1.1 and 1.2.1 contain the fix. Microsoft’s advisory notes that the vulnerability is not enabled by default in .NET or ASP.NET Core, but any application that opts in to Brotli decompression or uses the System.IO.Compression APIs can be affected.
Software hit by the flaw
Affected software spans several ecosystems. Microsoft patched .NET 8, 9, 10 and the 11 Release Candidate 3, while Visual Studio and PowerShell received corresponding builds. Node.js, PHP and several Linux distributions such as Debian, Alpine, Ubuntu and openSUSE have issued updated packages that include the corrected Brotli decoder. Red Hat has yet to release fixes for Enterprise Linux 7‑10, advising administrators to block or reject Brotli traffic from untrusted clients until a patch is available.
Microsoft recommends that users update as soon as possible and, if they cannot apply the patch immediately, block incoming Brotli‑compressed requests at a proxy or firewall, or disable Brotli decoding altogether. Because many applications bundle their own copy of the decoder, updating the system library alone does not mitigate the risk; services must be restarted or containers rebuilt to load the new code.
Proof‑of‑concept exploits have been published on GitHub, but no widespread attacks have been reported. Microsoft rates the flaw as critical for .NET and Visual Studio and important for PowerShell.