.NET out-of-band security update: Brotli fix, rebuild your apps

Microsoft shipped a .NET out-of-band security update on October 25 for .NET 8, 9 and 10, plus .NET 11 RC3. The main fix is CVE-2026-111497, the same Brotli decompression bug that hit Node.js this week. If you run ASP.NET Core in production, this one is not a "next Patch Tuesday" job. And if your app is self-contained or ships in a container, installing a new runtime on the server does nothing. You have to rebuild.

What actually happened

From Microsoft's .NET blog post:

• CVE-2026-111497: a buffer overflow in .NET's use of Brotli decompression. Microsoft says an unauthenticated attacker may be able to read or corrupt process memory. That can mean information disclosure, denial of service or elevation of privilege. All platforms are affected.
• Where Brotli is exposed: ASP.NET Core request decompression, HttpClient automatic response decompression, and the System.IO.Compression Brotli APIs. Microsoft notes that request decompression and automatic response decompression are not on by default.
• CVE-2026-114148: unsafe ownership metadata in some Linux tarballs could let a local attacker gain elevated privileges. On .NET 8 and 9, this also covers ASP.NET Core tarballs.
• Two re-released fixes: the October 13 release did not fully fix CVE-2026-70197 (SocketAsyncEventArgs memory corruption) or CVE-2026-102870 (Blazor WebAssembly debugger). Both are in this update.
• Fixed versions: 8.0.33, 9.0.22 and 10.0.14. Preview users go to .NET 11 RC3.
• .NET Framework is not affected.

One more date matters. Per Microsoft's support policy, .NET 8 and .NET 9 both reach end of support on November 10, 2026. That is 16 days from now. After that, the next Brotli-class bug gets no patch.

Why it matters for your business

Check if you turned decompression on. Search your code for UseRequestDecompression and for AutomaticDecompression on your HttpClient handlers. If you find either one, or you call BrotliStream on input you did not create, treat this as urgent.

Patch the right layer. Framework-dependent apps: update the runtime and restart. Self-contained apps: rebuild and republish, because the runtime ships inside the app. Containers: rebuild from updated base images and redeploy. Run dotnet --list-runtimes on each host to confirm.

Use this patch to start the .NET 10 move. If you are on .NET 8 or 9, you are patching an app that loses support in two weeks. .NET 10 is supported until November 2028. Plan the upgrade now, while you are already rebuilding.

Sources: .NET Blog: October 2026 out-of-band security updates, .NET support policy.