Microsoft releases emergency .NET patches for critical Brotli flaw

Microsoft has issued out-of-band security updates for .NET to fix a critical bug nicknamed Broccoli2Shell (also called Node2Shell or HTTP2Shell), tracked as CVE-2026-111497. The vulnerability, discovered by Imperva's Red Team, is an out-of-bounds write in the library that handles Google's Brotli compression format, and it can let an attacker send a specially crafted compressed stream to crash an application, leak memory, or in some scenarios achieve remote code execution or privilege escalation. Microsoft notes the risk mainly affects .NET apps that have explicitly enabled Brotli decompression features, such as ASP.NET Core request decompression or HttpClient's automatic response decompression, since this isn't turned on by default. Fixed builds are now available for .NET 8 (8.0.33), .NET 9 (9.0.22), .NET 10 (10.0.14), and .NET 11 Release Candidate 3; proof-of-concept code is already circulating publicly, though no in-the-wild attacks have been reported so far, and admins who can't patch immediately are advised to block Brotli-compressed traffic or disable the decoder.