NET October 2026 Out-of-Band Security Updates

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.

This out-of-band release addresses CVE-2026-111497 , a vulnerability in the Brotli decompression algorithm . It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.

Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression , HttpClient automatic response decompression , or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source.

For vulnerability details and affected products, see the linked security advisories.

Additionally, we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October 13, 2026 release did not fully address these issues. Today’s updates provide those fixes.

.NET 11 RC2 users should update to RC3 to receive these fixes.

Update your applications and build environments

Framework-dependent applications: Install the updated runtime for the .NET version your application targets, then restart the application.

Self-contained applications: Rebuild and republish with the updated runtime. Installing a newer runtime on the host does not update the runtime bundled with your application.

Containers: Rebuild and redeploy using updated .NET container images .

Source-build consumers: Obtain the updated source-build artifacts for your .NET version and rebuild your packages to incorporate the tarball ownership fix.

ASP.NET Core tarball users on .NET 8 and .NET 9: Update your installation using the refreshed ASP.NET Core Runtime tarball for your .NET version. This applies even if you do not build .NET from source.

You can check the runtimes installed on a machine with:

For framework-dependent deployments, confirm that the appropriate updated runtime listed above is installed. Self-contained applications and container deployments must be checked separately because they carry their own runtime.

See the .NET deployment documentation for more information framework-dependent and self-contained applications.

If you encounter a problem after updating, report it in the .NET release feedback issues .