The Modern .NET Show

S09E04 7mSeason 9

Artwork for S09E04b - The October 2026 Brotli Security Update: Who It Affects
S09E04
0:007m

The October 2026 Brotli Security Update: Who It Affects

A short bonus episode on CVE-2026-111497, the October 2026 Brotli security update for .NET. Who it affects, and what to install.

Episode Summary

This is a short bonus episode with one purpose. On October 25th, 2026, Microsoft released an unscheduled security update for .NET 8, .NET 9 and .NET 10. It fixes Common Vulnerabilities and Exposures (CVE) entry CVE-2026-111497, a flaw in the Brotli decompression library that .NET uses.

Most applications are not exposed. This episode explains how to tell whether yours is, and what to do if it is.

Topics covered in this episode include:

  • The three ways that an application can be exposed, and why none of them is the default
  • What the US Cybersecurity and Infrastructure Security Agency (CISA) listing of the flaw as exploited does and does not mean for .NET
  • How Microsoft rates the severity, on two different scales
  • What to install for .NET 8, .NET 9 and .NET 10
  • Why self-contained, Native AOT (ahead-of-time compiled) and container deployments need a rebuild
  • What the flaw means for versions from .NET Core 3.0 to .NET 7
  • What Microsoft’s “not affected” statement means for .NET Framework

The Security Note

Correct at the time of writing, which was November 2nd, 2026. Microsoft’s advisory and lifecycle pages are the authority, and they are linked at the end of these notes. Check them before you act on anything here.

This note applies only to some applications. An application is exposed only if its code decompresses Brotli data that comes from outside the application. Microsoft names three ways for this to happen:

  • ASP.NET Core request decompression, with Brotli (br) enabled
  • HttpClient automatic decompression that includes Brotli or All
  • Direct calls to BrotliStream or BrotliDecoder

ASP.NET Core and HttpClient do not decompress Brotli data automatically in their default configurations.

Severity and exploitation. Microsoft’s Security Update Guide rates this flaw Critical, on Microsoft’s own severity scale. Microsoft’s advisory on GitHub gives it a Common Vulnerability Scoring System (CVSS) 3.1 base score of 8.1, which the CVSS scale labels High. On October 27th, 2026, CISA added the CVE to its Known Exploited Vulnerabilities catalog. That listing is about the Google Brotli library in general. It does not name .NET. At the time of writing, Microsoft’s entry marks the flaw as not exploited, and its exploitability assessment reads “Exploitation More Likely”.

If you use .NET 8, .NET 9 or .NET 10. On October 25th, 2026, Microsoft released an out-of-band (unscheduled) security update for CVE-2026-111497. If your code uses Brotli decompression, install the latest patch for your version. At the time of writing, the fixed versions are .NET 8.0.33, .NET 9.0.22 and .NET 10.0.14. If you publish self-contained or Native AOT applications, rebuild and redeploy them. Updating the shared runtime does not replace the copy inside them. If you deploy in containers, rebuild and redeploy them with the updated .NET container images. At the time of writing, those images are published, and the 8.0, 9.0 and 10.0 tags already point to them. Make sure that your build pulls the new image and does not reuse a cached copy. Microsoft support for .NET 8 and .NET 9 ends on November 10th, 2026. This update may therefore be the last fix that Microsoft ships for them. Microsoft supports .NET 10 until November 14th, 2028.

Other Microsoft products. Microsoft’s Security Update Guide also lists PowerShell 7.4, 7.5 and 7.6 as affected. The fixed versions are 7.4.22, 7.5.13 and 7.6.9. It also lists Visual Studio 2017, 2019, 2022 and 2026.

If you use a version from .NET Core 3.0 to .NET 7. Jamie read the source code for the final release of each of these versions. Every one of them ships a version of the Brotli library that Google lists as affected by this CVE. These versions are out of support, so Microsoft does not release a fix for them. First, check whether your code uses Brotli decompression at all. If it does, plan a move to a supported version.

If you use .NET Framework. Microsoft states that .NET Framework is not affected by this CVE. This statement is about this CVE only. .NET Framework receives its own monthly security updates.

Episode Transcription

Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I’m your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem.

This is a short bonus episode. There’s no guest, and it isn’t part of Bridging the Gap. It’s a security note, and I didn’t want it to wait for the next scheduled episode.

Who This Is For

I’ll start with who this is for, so that nobody panics. It only matters if your code decompresses Brotli data that comes from outside your application. ASP.NET Core and HttpClient don’t do that by default. So if you’ve never switched it on, and you never call the Brotli APIs yourself, this isn’t about your application.

Microsoft lists three ways in. The first is ASP.NET Core’s request decompression, with Brotli enabled. The second is HttpClient’s automatic decompression, set to include Brotli, or set to all. And the third is calling BrotliStream or BrotliDecoder yourself. If none of those three is anywhere in your code, this isn’t about you.

What to Do

This was correct at the time of writing, which was November 2nd, 2026. Microsoft’s advisory and lifecycle pages are the authority, and they’re linked in the show notes. If you’re listening to this later, go and check them rather than trusting a recording.

There are two things I want to be precise about.

First, on October 27th, CISA, the US Cybersecurity and Infrastructure Security Agency, added this flaw to its list of known exploited vulnerabilities. That listing is about Google’s Brotli library, which a lot of software uses, not only .NET. The attack write-ups I’ve seen are about Node.js, and nothing I’ve read says a .NET application has been attacked through it. At the time of writing, Microsoft’s own entry says it hasn’t been exploited, and rates exploitation as more likely. So if your code is exposed, don’t wait.

Second, how serious is it? That depends on whose scale you use. Microsoft’s Security Update Guide rates it Critical, on Microsoft’s own scale. Microsoft’s advisory on GitHub gives it 8.1 out of 10 on the Common Vulnerability Scoring System, which that scale labels High. Same flaw, two scales.

On October 25th, Microsoft shipped an unscheduled fix for .NET 8, 9 and 10. If your code uses Brotli decompression, install the latest patch for your version. The version numbers are in the show notes.

And if you publish self-contained applications, or Native AOT ones, where the whole thing’s compiled ahead of time, updating the runtime on the server isn’t enough. Each of those applications carries its own copy of the runtime, so you need to rebuild it and redeploy it. The same goes for containers: rebuild them on the updated .NET container images, and redeploy. I checked, and those images are already published, and the eight, nine and ten tags already point at them. Just make sure your build actually pulls the new image, rather than reusing one it cached weeks ago.

Microsoft’s support for .NET 8 and .NET 9 ends on November 10th, so this may be the last fix Microsoft ships for them. .NET 10 is supported until November 2028. I went through what that end of support means a couple of weeks ago, in the episode about .NET 8 and .NET 9, and it’s linked in the show notes.

Older Versions

I also read the source code for the final release of every version from .NET Core 3.0 through to .NET 7. Every one of them ships a version of the Brotli library that Google lists as affected, and Microsoft isn’t fixing any of them, because they’re out of support. If that’s you, first check whether your code uses Brotli decompression at all. If it does, the route is a move to a supported version.

.NET Framework

And if you’re on .NET Framework: Microsoft says .NET Framework is not affected. That’s a statement about this one vulnerability, and nothing more. .NET Framework gets its own security updates every month, like everything else.

That’s It

The details, a checklist and the version numbers are in the show notes. Bridging the Gap carries on with part three on November 20th, and the regular episodes carry on as normal in between.

Thank you for listening. Be kind to yourselves, be kind to each other. I’ll see you in the next one.

Wrapping Up

Thank you for listening to this episode of The Modern .NET Show with me, Jamie Taylor. Let me know if you found this monologue interesting or useful. I’d love to know if you did, and whether you’d like me to create more of them.

Be sure to check out the show notes for a bunch of links to some of the stuff that we covered, and full transcription of this episode. The show notes, as always, can be found at the podcast's website, and there will be a link directly to them in your podcatcher.

And don’t forget to spread the word, leave a rating or review on your podcatcher of choice (head over to dotnetcore.show/review for ways to do that), reach out via our contact page, or join our discord server at dotnetcore.show/discord (all of which are linked in the show notes).

But above all, I hope you have a fantastic rest of your day, and I hope that I’ll see you again, next time for more .NET goodness.

I will see you again real soon. See you later folks.

↑ ↓ to move · enter to open · esc to close