Microsoft released emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 on October 26, 2026, addressing CVE-2026-111497 (Brotli buffer overflow) and three additional vulnerabilities. CVE-2026-111497 is a critical out-of-bounds write in Brotli decompression affecting ASP.NET Core and HttpClient; attackers can read/corrupt memory leading to information disclosure, DoS, or privilege escalation. Affected versions prior to .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3 require immediate patching.
- Microsoft Issues Emergency .NET Security Updates to Fix Four Vul(opens in a new tab)
- HTTP2Shell CVE-2026-111497: Brotli RCE in Node.js and Python - P(opens in a new tab)
- .NET October 2026 Out-of-Band Security Updates - .NET Blog(opens in a new tab)
- Microsoft Launches Critical Security Update for .NET Brotli Flaw(opens in a new tab)
- Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-20(opens in a new tab)
- Microsoft Issues Emergency Patch Update for Critical .NET Buffer(opens in a new tab)
// Get alerts for Microsoft Azure