Microsoft Disrupts .NET with Emergency Patches for Brotli Flaw

CVE-2026-111497 — tracked publicly as Broccoli2Shell, Node2Shell and HTTP2Shell — is a critical out-of-bounds write in the Brotli decoder that can lead to crashes, memory leaks and, in some cases, remote code execution, Microsoft and the vulnerability researcher who found it warn.

How the Broccoli2Shell bug operates

Imperva Red Team discovered the flaw, which stems from an out-of-bounds write in the Brotli decoder that expands data compressed using Google's widely used Brotli lossless compression algorithm. Microsoft’s advisory says a successful exploit can let an unprivileged attacker craft a Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries.

Microsoft’s advisory also warns the vulnerability can be used to “remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations,” increasing its potential impact where .NET apps are configured to accept Brotli-compressed input.

Which .NET components and application paths are at risk

Microsoft named the specific application paths most likely to be affected. “Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs,” Microsoft said.

The company emphasized a critical configuration detail: “Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET.” That opt-in requirement narrows the default attack surface but shifts responsibility to app owners and developers who enable Brotli features.

Microsoft’s emergency patches and the immediate advisory

Microsoft released out-of-band (OOB) security updates to address the bug for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3 and advised “updating as soon as possible.” The updates are intended to remediate the vulnerable Brotli decoder behavior in the managed .NET distributions Microsoft maintains.

Proof-of-concept exploits for Broccoli2Shell have already been published on GitHub, the advisory noted, but Microsoft and public trackers report no confirmed cases of malicious exploitation in the wild to date.

Mitigations for teams that cannot patch immediately

For organizations that cannot install the out-of-band updates immediately, Microsoft and public guidance offer short-term mitigations: block incoming Brotli-compressed requests at the edge (for example, with a proxy or firewall) or disable Brotli decoding inside affected applications until patches can be applied.

A dedicated online portal tracking the flaw cautions that updating the system Brotli library alone does not fully address the risk for applications that bundle their own copy of the Brotli library. In other words, hosts may be patched at the OS level while individual applications remain vulnerable if they ship their own Brotli implementation.

What this means for security teams, application developers, and enterprise IT

• Security teams: Prioritize the out-of-band .NET updates for .NET 8, 9, 10 and .NET 11 RC3, and consider temporary edge controls (block Brotli-compressed requests) where updates cannot be deployed immediately. Track published PoC code on GitHub and monitor for any signs of exploitation.
• Application developers: Audit applications to determine whether they have explicitly opted in to Brotli request or response decompression or if they call the System.IO.Compression Brotli APIs directly. Also identify any bundled Brotli libraries inside application packages that will not be fixed by system-level updates.
• Enterprise IT: Treat .NET instances with non-default decompression configurations as higher priority for patching, and coordinate with developer teams to ensure in-app or bundled libraries are updated or mitigated where necessary.

The advisory and tracking data underscore a broader caution: prevention metrics can be misleading once attackers achieve initial access. “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply,” a report cited in the advisory materials observes — the Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

For now the immediate task is narrow and concrete: apply Microsoft's out-of-band .NET updates as directed, or enforce edge controls to block Brotli-compressed traffic until patches can be deployed, while auditing applications for bundled Brotli code that will not be covered by system updates.

Source: BleepingComputer — Microsoft releases emergency .NET patches for critical Brotli flaw