Microsoft Releases Emergency Patches for Critical Brotli Decoder Vulnerability in .NET

two grey CCTV cameras — Miłosz Klinowski / Unsplash

Microsoft has released out-of-band security updates for .NET to address a critical vulnerability in the Brotli decoder.

The flaw, identified as CVE-2026-111497, is known by the names Broccoli2Shell, Node2Shell, or HTTP2Shell. It stems from an out-of-bounds write within the Brotli decoder, which handles the decompression of data using the lossless compression algorithm developed by Google.

Unprivileged attackers can exploit this vulnerability by sending a specially crafted Brotli-compressed stream. This action may cause a system crash or a memory leak. In certain instances, it could allow for remote code execution on devices utilizing the affected Brotli binary or library. Microsoft stated that attackers could also use the flaw for remote privilege escalation on systems with .NET installed that use non-default configurations and remain unpatched.

The vulnerability affects HTTP clients and servers, as well as other tools and applications using the vulnerable Brotli implementation. Specifically, affected applications are those that process Brotli data through HttpClient automatic response decompression, ASP.NET Core request decompression, or the System.IO.Compression Brotli API. Brotli decompression is not enabled by default in new installations of .NET or ASP.NET Core, meaning applications must manually enable the decompression features or call the API directly.

Microsoft provided updates for several versions of .NET. .NET 8 has been updated to 8.0.33.NET 9 to 9.0.22, and .NET 10 to 10.0.14. Additionally.NET 11 Release Candidate 3 has been updated. While a proof-of-concept exploit for Broccoli2Shell has been published on GitHub, there are no reports of actual attacks.

Warnings have been issued that updating the system Brotli library does not resolve risks for applications that bundle their own Brotli library. For organizations unable to update immediately, recommendations include disabling Brotli decoding temporarily or blocking Brotli-compressed requests using a firewall or proxy.