Microsoft issues emergency .NET patches for critical Brotli flaw ‘Broccoli2Shell’

Vulnerability could allow remote code execution; no active exploitation reported yet

By LineZotpaper AI staff

Published26 October 2026

Read Time2 min

Microsoft has released out-of-band security updates for .NET to address a critical vulnerability in the Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Broccoli2Shell. The flaw, discovered by Imperva Red Team, could allow unprivileged attackers to execute arbitrary code on systems processing maliciously crafted Brotli-compressed data.

The vulnerability stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. Microsoft's advisory, published Sunday, warns that successful exploitation can trigger crashes, memory leaks, or remote code execution on devices with vulnerable Brotli binaries or libraries. Attackers may also remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.

"Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs," Microsoft said. The company noted that Brotli decompression is not enabled by default in out-of-the-box .NET or ASP.NET Core installs; applications must manually opt in.

To address the issue, Microsoft has released updates for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3, and urged users to update as soon as possible.

While proof-of-concept exploits for Broccoli2Shell have been published on GitHub, no malicious exploitation has been reported in the wild. Microsoft warned that updating the system Brotli library does not protect applications that bundle their own copy of the library. For those unable to patch immediately, blocking incoming Brotli-compressed requests via proxy or firewall, or disabling Brotli decoding, are recommended workarounds.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The flaw affects a wide range of .NET applications, potentially exposing servers and services to remote code execution.
Brotli compression is used across the web and in many applications; similar flaws could have broad impact.
With proof-of-concept code already public, the window for attackers to weaponise the vulnerability is narrowed, making rapid patching critical.

Background

Brotli is a lossless compression algorithm developed by Google, widely adopted for web content compression and in many software libraries. The vulnerability, discovered by Imperva's Red Team, resides in Microsoft's implementation of the Brotli decoder. Out-of-bounds write vulnerabilities are among the most dangerous, often leading to arbitrary code execution.

What to Watch

Whether threat actors begin exploiting the flaw in the wild, especially given public PoC code.
Adoption rate of the emergency patches by organisations running affected .NET versions.
Updates from Microsoft regarding any additional platforms or versions that may be affected.

Sources

Microsoft releases emergency .NET patches for critical Brotli flaw · BleepingComputer

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedMicrosoft issued emergency .NET security patches for the critical Brotli flaw known as Broccoli2Shell.BleepingComputer: “Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell”
SupportedThe flaw could allow remote code execution, and no malicious exploitation in the wild had been reported.BleepingComputer: “in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries. [...] no reports of malicious exploitation in the wild have emerged.”
SupportedThe vulnerability is tracked as CVE-2026-111497 and was found by Imperva Red Team.BleepingComputer: “Tracked as CVE-2026-111497 , this critical-severity flaw was found by Imperva Red Team”
SupportedThe flaw is an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's Brotli lossless compression algorithm.BleepingComputer: “stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm.”
SupportedUnprivileged attackers could use maliciously crafted Brotli-compressed data to cause crashes or memory leaks and, in some cases, remote code execution.BleepingComputer: “Successful exploitation lets unprivileged attackers use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution”
SupportedMicrosoft's advisory, published Sunday, says attackers can also remotely escalate privileges on unpatched .NET installations using non-default configurations.BleepingComputer: “According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.”
SupportedMicrosoft said: “Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs,”BleepingComputer: “"Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs," Microsoft said .”
SupportedBrotli decompression is not enabled by default in out-of-the-box .NET or ASP.NET Core installations, and applications must opt in.BleepingComputer: “Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in”
SupportedMicrosoft released updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3, and urged users to update as soon as possible.BleepingComputer: “Microsoft has released out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3, and advised "updating as soon as possible."”
SupportedProof-of-concept exploits for Broccoli2Shell were published on GitHub, but no malicious exploitation in the wild had been reported.BleepingComputer: “While proof-of-concept (PoC) exploits for Broccoli2Shell have already been published on GitHub, no reports of malicious exploitation in the wild have emerged.”
Not in the sourcesMicrosoft warned that updating the system Brotli library does not protect applications that bundle their own copy.BleepingComputer: “A dedicated online portal tracking the flaw warns that updating the system Brotli library doesn't address the risk in apps that bundle their own copy of the library.”
SupportedFor those unable to patch immediately, blocking incoming Brotli-compressed requests with a proxy or firewall, or disabling Brotli decoding, are suggested workarounds.BleepingComputer: “Those who can't apply the updates immediately should block incoming Brotli-compressed requests using a proxy or firewall, or disable Brotli decoding until they can apply a patch.”