.NET 8.0.33, 9.0.22 and 10.0.14 Fix the Brotli Flaw CVE-2026-111497 Out of Band: Update the Runtime and Rebuild Self-Contained Apps
On October 25, 2026 Microsoft shipped out-of-band security updates for .NET: 8.0.33, 9.0.22 and 10.0.14 (and Release Candidate 3 for .NET 11). They fix CVE-2026-111497, a buffer overflow in .NET’s use of the Brotli decompression algorithm. The same CVE number is behind the Ubuntu and Node.js fixes I covered earlier, because it is one flaw in the shared Brotli code.
The .NET announcement says an unauthenticated attacker could read or corrupt process memory, which can lead to information disclosure, denial of service or elevation of privilege. It also re-releases two advisories that the October 13 release did not fully fix. The page does not give a CVSS score, so check the linked Microsoft advisories for that.
Quick guide
- List what you have with
dotnet --list-runtimesanddotnet --list-sdks. - Check whether your apps use Brotli decompression (the three places are below).
- Update the runtime to 8.0.33, 9.0.22 or 10.0.14 or newer and restart the applications.
- Rebuild and republish self-contained apps. Updating the host runtime does not change the copy inside them.
- Rebuild containers from updated .NET images.
Are you actually exposed?
According to the announcement, an app is affected only if it processes Brotli compressed data through one of three paths: ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Neither decompression feature is turned on by default. .NET Framework is not affected. A quick search of your source tree shows whether you use any of them:
grep -rnE "BrotliStream|AddRequestDecompression|DecompressionMethods" --include=*.cs .No match does not prove you are safe, because a library you depend on might use Brotli. It does tell you whether your own code turns it on.
Confirm the new versions exist
for v in 8.0 9.0 10.0
do
curl -s https://builds.dotnet.microsoft.com/dotnet/release-metadata/$v/releases.json \
| jq -r '.releases[0] | "\(."release-version") \(."release-date") security=\(.security)"'
donecurl -s https://builds.dotnet.microsoft.com/dotnet/release-metadata/8.0/releases.json \
| jq -r '.releases[0]."cve-list"[]."cve-id"'
This reads Microsoft’s own release metadata. The three versions all carry security=true and the 8.0 release lists CVE-2026-111497, CVE-2026-70197 and CVE-2026-114148. The second is the memory corruption advisory that was re-released, and the third is the Linux tarball ownership issue.
The other two fixes in the same release
| CVE | What it is | Who is affected |
|---|---|---|
| CVE-2026-111497 | Brotli buffer overflow | All platforms, apps that use Brotli decompression |
| CVE-2026-114148 | Unsafe ownership metadata in tarballs lets a local attacker modify files and gain privileges | Linux. .NET 8 and 9 including ASP.NET Core tarball distributions, .NET 10 and 11 source-build tarballs only |
| CVE-2026-70197 | SocketAsyncEventArgs memory corruption, re-released | .NET 8, 9, 10 and 11 |
| CVE-2026-102870 | Blazor WebAssembly debugger, re-released | .NET 10 and 11 |
Do not forget the support deadline
.NET 8 and 9 stop getting support on November 10, 2026. If you are updating anyway, this is a good time to plan the move, and I wrote a checklist for finding every runtime and app in my .NET 8 and 9 end of support post.
Caveats
- I did not install .NET on any machine for this post. My Linux server and my lab domain controller have no dotnet, so I am showing Microsoft’s release metadata and not an upgrade.
- The exposure details come from the .NET announcement. I did not test whether any app can be attacked.
- For the Brotli flaw in Ubuntu packages see my earlier post, and for Node.js see my Node.js post. Each product bundles or links its own copy, so each needs its own fix.
FAQ
Which .NET versions fix CVE-2026-111497?
8.0.33, 9.0.22 and 10.0.14, released October 25, 2026, and .NET 11 Release Candidate 3.
Is .NET Framework affected?
The announcement says it is not.
My app is self-contained. Does updating the runtime fix it?
No. Self-contained apps carry their own runtime, so rebuild and republish them.
Is my app affected if I never enabled decompression?
Neither request decompression nor automatic response decompression is on by default. The risk is for apps that turn them on or call the Brotli APIs directly.
How do I list installed .NET runtimes?
Run dotnet –list-runtimes and dotnet –list-sdks. Self-contained apps and containers must be checked separately.
