Affected Systems

Microsoft .NET 8, 9, 10, and 11 RC3. Applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are vulnerable. Brotli decompression is NOT enabled by default; applications must explicitly opt in or manually invoke Brotli APIs.

Exploitation Status

Proof-of-concept exploits published on GitHub. No confirmed active exploitation in the wild as of publication date (October 26, 2026).

Business Impact

Out-of-bounds write vulnerability (CVE-2026-111497) allows unprivileged remote attackers to crash applications, cause memory leaks, or achieve remote code execution by sending malicious Brotli-compressed streams. Privilege escalation is possible on systems with non-default .NET configurations. Risk is limited to applications that explicitly enable Brotli decompression or use Brotli APIs—not all .NET deployments are vulnerable by default. Public PoC availability increases exploitation risk significantly.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Immediately inventory all .NET 8, 9, 10, and 11 RC3 deployments and identify applications using ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression.Brotli APIs.
  • Apply Microsoft out-of-band patches: .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 RC3. Prioritize internet-facing applications and services processing untrusted HTTP traffic.
  • For applications that cannot be patched immediately, block incoming Brotli-compressed requests (Content-Encoding: br) at proxy, WAF, or firewall layer, or disable Brotli decoding in application configuration.
  • Verify that applications bundling their own Brotli library copies are updated independently, as system-level Brotli patches do not protect statically linked or embedded libraries.
  • Monitor application logs and network traffic for unusual Brotli-compressed payloads or unexpected crashes in decompression routines; correlate with CVE-2026-111497 indicators of compromise.