Skip to content
Critical Brotli Vulnerability in .NET Requires Immediate Patching

Critical Brotli Vulnerability in .NET Requires Immediate Patching

First seen 27 Oct 2026, 10:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 11:12 UTC
  • •CVE-2026-111497 is a critical vulnerability with a CVSS score of 9.2.
  • •Proof-of-concept exploit code is publicly available, increasing the risk of exploitation.
  • •Microsoft recommends immediate patching for affected .NET versions to prevent remote code execution.

Microsoft released an emergency out-of-band patch on October 26, 2026, for CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library affecting .NET versions 8, 9, 10, and 11 RC3. This flaw allows unauthenticated remote attackers to exploit affected applications, potentially leading to remote code execution, memory corruption, and information disclosure. The vulnerability was discovered on October 22, 2026, and proof-of-concept exploit code was made publicly available on GitHub the same day. Applications using ASP.NET Core request decompression, HttpClient response decompression, or Brotli APIs are particularly at risk. Microsoft confirmed that the vulnerability does not affect the .NET Framework and that Brotli decompression is not enabled by default. Organizations are urged to apply the patch immediately to mitigate risks, especially those with internet-facing services. The vulnerability has been rated with a CVSS score of 9.2, indicating its critical nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-01-14
CVE-2025-21172 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-08
CVE-2026-11497 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-111497 disclosed
Microsoft announced a critical out-of-bounds write vulnerability in Brotli affecting .NET versions.
Firstpost
2026-10-26
Emergency patch released
Microsoft issued an emergency update for .NET to address the critical Brotli vulnerability.
Firstpost
2026-10-27
Public PoC exploit available
Proof-of-concept exploit code for CVE-2026-111497 was made publicly available on GitHub.
Aviatrix.Ai

More articles in this cluster (8)

Following this threat?

Track CVE-2025-21172 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 4

Common questions

Which .NET versions are affected?
The vulnerability affects .NET 8, 9, 10, and 11 RC3.
Is there any active exploitation reported?
Currently, there is no confirmed exploitation in the wild, but PoC code is publicly available.
What should organizations do?
Organizations should immediately apply the emergency patch released by Microsoft to mitigate risks.