Microsoft has issued emergency .NET security updates to fix a critical vulnerability in the Brotli decoder. The flaw is known as Broccoli2Shell and is also tracked as Node2Shell and HTTP2Shell. It is tracked as CVE-2026-111497 and was found by the Imperva Red Team. The vulnerability stems from an out-of-bounds write in the decoder, which expands data compressed with Google's widely used Brotli lossless compression algorithm.
Exploitation allows unprivileged attackers to use a maliciously crafted Brotli-compressed stream to cause crashes or memory leaks and, in some cases, to gain remote code execution on devices running vulnerable Brotli binaries or libraries. According to a Microsoft advisory published Sunday, attackers can also use the flaw to escalate privileges remotely on systems with unpatched .NET installations that use non-default configurations.
Microsoft said applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. The company said Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or manually invoke the Brotli decompression APIs provided by .NET.
To address the flaw, Microsoft has released out-of-band security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. The company advised updating as soon as possible. Proof-of-concept exploits for Broccoli2Shell have already been published on GitHub, but no reports of malicious exploitation in the wild have emerged.
A dedicated online portal tracking the flaw warns that updating the system Brotli library does not address the risk in apps that bundle their own copy of the library. Users who cannot apply the updates immediately should block incoming Brotli-compressed requests using a proxy or firewall, or disable Brotli decoding until they can apply a patch, according to the portal.
The disclosure comes as defenders weigh how much protection holds up after an attacker has already gained a foothold. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Its findings indicate that overall prevention scores can hide what happens after initial access, and that once attackers are using valid credentials, prevention drops sharply.
More cybersecurity news from TechManNews.
