Overview
Microsoft has shipped emergency, out-of-band .NET security updates for a critical vulnerability in the Brotli decoder, tracked as CVE-2026-111497. The flaw is also called Broccoli2Shell, Node2Shell and HTTP2Shell. The advisory was published on a Sunday.
The root cause is an out-of-bounds write in the code that expands Brotli-compressed data. An unprivileged attacker who sends a crafted Brotli stream can cause crashes or memory leaks, and in some cases remote code execution. Microsoft also says attackers could escalate privileges remotely on unpatched systems with non-default configurations.
Who Is Affected
Brotli decompression is not enabled by default in .NET. An application is exposed if it decompresses Brotli data through any of these paths:
- ASP.NET Core request decompression
HttpClientautomatic response decompression- The
System.IO.CompressionBrotli APIs
Fixed Versions
| Release | Patched version |
|---|---|
| .NET 8 | 8.0.33 |
| .NET 9 | 9.0.22 |
| .NET 10 | 10.0.14 |
| .NET 11 | Release Candidate 3 |
Exploitation Status
Proof-of-concept exploits are published on GitHub. No malicious exploitation in the wild had been reported when the patches were announced. Given the public PoCs, that window is likely to be short.
What To Do
- Update to the patched .NET versions above and redeploy or restart affected services.
- If you cannot patch right away, block Brotli-compressed requests (
Content-Encoding: br) at a proxy or firewall, or disable Brotli decoding in the application. - Check bundled copies. Updating the system Brotli library does not fix applications that ship their own decoder, so those need their own updates.
- Inventory services that enable request decompression or automatic response decompression, since those are the reachable attack surface.
The same Brotli decoder bug affects other runtimes as well. See our earlier coverage of CVE-2026-111497 in Node.js, Bun, Python, Envoy and Istio.