Microsoft has released emergency out-of-band security updates for a critical Brotli decompression vulnerability that can expose .NET applications to memory corruption, information disclosure, denial of service and potential remote privilege escalation.
The flaw, CVE-2026-111497, is also known as HTTP2Shell, Node2Shell and Broccoli2Shell. It affects the widely embedded Brotli decoder rather than a single programming framework, creating exposure across multiple runtimes and applications.
Microsoft recommends updating affected .NET installations as soon as possible. No exploitation in real-world attacks has been confirmed, but researchers have demonstrated code execution in a laboratory, and public proof-of-concept material is available.
MALICIOUS COMPRESSED DATA CAN CORRUPT PROCESS MEMORY
CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decompression code.
A specially constructed compressed stream can cause the decoder to write beyond an internal buffer, corrupting adjacent process memory. Depending on the affected application and runtime configuration, exploitation may cause a crash, disclose information or enable attacker-controlled code to execute with the process’s privileges.
The CVE carries a critical CVSS 4.0 score of 9.2. Microsoft says an unauthenticated attacker may be able to read or corrupt process memory through a vulnerable .NET application.
The vulnerability becomes remotely reachable when an application decompresses attacker-controlled Brotli content. Simply having an affected library installed does not prove that a specific service is remotely exploitable.
.NET APPLICATIONS REQUIRE SPECIFIC EXPOSURE PATHS
Microsoft identified three principal ways a .NET application may process dangerous Brotli data:
- ASP.NET Core request decompression
- HttpClient automatic response decompression
- Direct use of System.IO.Compression Brotli APIs
Request and automatic response decompression are not enabled in a default .NET or ASP.NET Core installation. Applications must opt into those features or explicitly invoke Brotli decompression.
This distinction should guide prioritization, but it should not delay installation of the emergency updates. Internet-facing applications that decode compressed request bodies deserve immediate attention.
Outbound request paths may be equally important. An attacker could potentially return a malicious Brotli response to an application that retrieves an attacker-controlled URL through a webhook, link-preview service, crawler, document importer, image proxy or AI browsing agent.
A web-application firewall monitoring inbound requests may not observe that outbound response.
MICROSOFT PUBLISHES FIXED .NET RELEASES
Microsoft released the following corrected versions:
- .NET 8.0.33
- .NET 9.0.22
- .NET 10.0.14
- .NET 11 Release Candidate 3
.NET Framework is not affected.
Framework-dependent applications require the updated runtime to be installed on the host, followed by an application restart.
Self-contained applications bundle their own runtime. Installing the corrected runtime on the operating system will not update those deployments. They must be rebuilt and republished using a fixed .NET version.
Containerized applications must likewise be rebuilt with corrected base images and redeployed. Restarting an existing vulnerable container does not replace its embedded runtime.