As reported by BleepingComputer, Microsoft has released out-of-band emergency security updates for .NET 8, 9, 10, and .NET 11 RC3 to address a critical vulnerability in the Brotli compression decoder — CVE-2026-111497, also tracked under the names Broccoli2Shell, Node2Shell, and HTTP2Shell. The decision to patch outside the normal Patch Tuesday cycle, combined with the public availability of proof-of-concept exploit code on GitHub, elevates this from a routine library bug to an issue demanding immediate operational attention.
Why This Matters Beyond the Headline
The vulnerability is an out-of-bounds write in the Brotli decoder — the component responsible for decompressing data encoded with Google's Brotli algorithm. Brotli is not a niche library; it is the dominant content-encoding mechanism for HTTP/2 and HTTP/3 traffic, supported by every major browser, CDN, and reverse proxy. The attack surface is therefore enormous in principle, but the practical exposure for .NET environments depends on a critical detail that Microsoft's advisory underscores: Brotli decompression is not enabled by default in stock .NET or ASP.NET Core installations.
This means the population of truly vulnerable systems is narrower than initial headlines might suggest — but it is still significant. Any application that has explicitly opted into ASP.NET Core request decompression, configured HttpClient automatic response decompression, or manually invoked the System.IO.Compression Brotli APIs is exposed. These are common patterns in API gateways, microservices that consume third-party HTTP APIs, and web applications that accept compressed uploads or process external content streams.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-111497 |
| Severity | Critical (exact CVSS pending in NVD) |
| Flaw Type | Out-of-bounds write in Brotli decoder |
| Impact | Crash, memory leak, potential remote code execution, remote privilege escalation (non-default configs) |
| Affected Software | .NET 8, .NET 9, .NET 10, .NET 11 RC3 and any application bundling a vulnerable Brotli library copy |
| Attack Vector | Maliciously crafted Brotli-compressed stream sent to HTTP clients or servers |
| Patch Available | Yes — .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, .NET 11 RC3 |
| Active Exploitation | None confirmed in the wild as of publication; PoC exploits publicly available on GitHub |
The Bundled Library Problem
The most underappreciated aspect of this advisory is the warning that updating the system-level Brotli library does not remediate the risk for applications that statically bundle their own copy.
Many modern applications — especially those built with .NET single-file deployments, containerized microservices, or NuGet package dependencies — carry their own internal copy of the Brotli binary. Patching the OS package manager's version of libbrotli will not touch these embedded copies. Security and engineering teams must inventory not just the runtime version but also every published application artifact that ships Brotli internally. This is a software supply chain hygiene problem, not merely a patching problem.
Who Is Most at Risk
Shield53 Recommendations — Immediate Actions
- Patch immediately. Update all .NET 8, 9, and 10 runtimes and SDKs to the versions listed above. For .NET 11 RC3 environments, apply the updated release candidate. Prioritize internet-facing systems first.
- Inventory bundled Brotli copies. Use dependency scanning (e.g., SBOM generation via CycloneDX or Syft) across all published .NET application artifacts. Rebuild and redeploy any container images, single-file executables, or NuGet packages that statically link a vulnerable Brotli version.
- Deploy interim network mitigations. If patching cannot be completed within 72 hours, block or strip Brotli-compressed requests at the edge using WAF rules, reverse proxy configuration, or API gateway policies. Disable Brotli response decompression in HttpClient configurations until patches are applied.
- Detect potential exploitation. Monitor for anomalous crash patterns in ASP.NET Core worker processes, unexpected memory consumption spikes, and unusually large or malformed Content-Encoding: br headers in inbound HTTP traffic. Configure alerting on repeated process restarts in application hosts.
- Validate non-default configurations. Audit all .NET application configuration files for explicit enabling of Brotli decompression — including
RequestDecompressionOptions,AutomaticDecompression.GZip | DecompressionMethods.Brotlion HttpClient handlers, and directBrotliDecoderAPI usage. Document each instance as part of your attack surface map.
The gap between PoC publication and active exploitation in the wild is typically measured in days, not weeks. With proof-of-concept code already circulating publicly, organizations should treat this window as closing rapidly and prioritize remediation accordingly. The fact that Microsoft chose an out-of-band release — breaking their own Patch Tuesday cadence — is a strong signal that they assess the real-world risk as elevated. Defenders should match that urgency.
