Microsoft has released an emergency .NET security update for a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. The flaw, identified as CVE-2026-111497 and discovered by the Imperva Red Team, affects the Brotli decoder and could enable crashes, memory leaks, or potentially remote code execution.
Critical flaw in Brotli decompression
The vulnerability is caused by an out-of-bounds write in the Brotli decoder, which decompresses data compressed with Google’s widely used Brotli lossless compression algorithm.
A successful exploit could allow an unprivileged attacker to send a maliciously crafted Brotli-compressed stream to a vulnerable Brotli binary or library. This could cause a crash or memory leak and may potentially lead to remote code execution.
According to Microsoft’s advisory, published Sunday, attackers could also exploit the flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.
“Applications may be affected if they decompress ASP.NET Core requests, decompress HttpClient auto-responses, or process Brotli compressed data through the System.IO.Compression Brotli API,” Microsoft said.
Microsoft added that Brotli decompression is not enabled by default in out-of-the-box .NET or ASP.NET Core installations. Applications must manually enable ASP.NET Core request decompression or HttpClient response decompression, or explicitly call the Brotli decompression API provided by .NET.
Microsoft releases out-of-band updates
Microsoft released an out-of-band security update for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. The company recommends that users “update as soon as possible.”
A proof-of-concept exploit for Broccoli2Shell has already been published on GitHub, although there have been no reports of the vulnerability being exploited in the wild.
A dedicated online portal tracking the vulnerability warns that updating the Brotli library on a system may not address the risk posed by applications that bundle their own copies of the library.
Organizations that cannot apply the update immediately may need to use a proxy or firewall to block incoming Brotli-compressed requests, or disable Brotli decoding until the patch can be installed.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com