Microsoft issues out-of-band updates across four .NET versions to tackle a severe Brotli vulnerability

Microsoft has issued emergency security updates across .NET 8, 9, 10, and .NET 11 Release Candidate 3 to address a high-severity buffer overflow flaw in Google's Brotli compression library. Tracked as CVE-2026-111497 and dubbed Broccoli2Shell, the vulnerability was rated 8.1 under CVSS v3.1 by Microsoft, which is urging administrators to patch immediately even though it has observed no active exploitation by attackers. [1][2]

The bug resides in Brotli's decompression routines and allows unauthenticated attackers to supply malicious compressed data to trigger memory corruption, leaks, denial of service, or elevated privileges. Microsoft clarified that out-of-the-box .NET installations are not exposed by default, though applications become vulnerable if they manually use Brotli APIs or opt into decompression through HttpClient or ASP.NET Core. [1][2]

The fix arrives after similar patches from Node.js, Python, Bun, Envoy, and Istio, reflecting how deeply the library is embedded across modern infrastructure. Cybersecurity firm Wiz warned that 91 percent of cloud environments rely on components containing the flaw, prompting OpenAI and other security teams to advise operators to block untrusted Brotli traffic at the firewall or reverse proxy until systems are rebuilt and restarted. [1][2]