Microsoft patches critical Brotli decoder flaw across .NET versions

Microsoft issued out-of-band security patches addressing a critical vulnerability affecting its .NET framework. The flaw, designated CVE-2026-111497 and known by multiple names including Broccoli2Shell, Node2Shell, and HTTP2Shell, was discovered by the Imperva Red Team and involves an out-of-bounds write condition in the Brotli decoder component.

The vulnerability exists in how the Brotli decoder processes data compressed with Google's Brotli lossless compression algorithm. An attacker crafting a malicious Brotli-compressed stream could trigger application crashes, memory leaks, or in certain scenarios, achieve remote code execution on systems containing vulnerable Brotli binaries or libraries. On systems with non-default .NET configurations, the flaw may also enable remote privilege escalation.

Microsoft stated in its advisory released Sunday that the vulnerability affects applications processing Brotli-compressed data through specific mechanisms. According to the company, "Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs."

The company emphasized that Brotli decompression does not ship as an enabled feature by default. Microsoft noted: "Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET."

Emergency patches have been released for .NET 8, .NET 9, and .NET 10, as well as .NET 11 Release Candidate 3. Microsoft has advised organizations to apply these updates without delay.

Proof-of-concept code demonstrating the vulnerability has already surfaced on GitHub, though active exploitation attempts have not yet been documented. A tracking resource for the vulnerability warns that updating the system-level Brotli library alone does not mitigate risk for applications that include their own bundled copy of the library.

For organizations unable to deploy patches immediately, interim protective measures include blocking incoming Brotli-compressed requests at the network perimeter using proxy or firewall rules, or temporarily disabling Brotli decompression functionality until patches can be applied.