Microsoft Issues Out-of-Band Security Update for .NET to Fix Critical Brotli Decoder Vulnerability
TechTalkThai
Key summary
Microsoft has released an out-of-band (OOB) security update for the .NET framework to address a critical vulnerability in the Brotli decoder known as Broccoli2Shell, Node2Shell, or HTTP2Shell. The flaw, identified as CVE-2026-111497, stems from an out-of-bounds write in the Brotli decoder and affects both HTTP clients and servers using the affected implementation. Microsoft recommends immediate updates for .NET 8 (v8.0.33), .NET 9 (v9.0.22), .NET 10 (v10.0.14), and .NET 11 Release Candidate 3. While a proof-of-concept exploit exists on GitHub, no actual attacks have been reported yet.
M31 has compiled the key facts based on reporting from the source below. Please refer to the original article for details.
This article was restructured with AI-assisted translation and may contain errors. Please refer to the original source below for accuracy.
Official source
TechTalkThai
Read original ↗https://www.techtalkthai.com/microsoft-out-of-band-dotnet-update-fixes-critical-brotli-vulnerability/