Microsoft Issues Out-of-Band .NET Update for Brotli Flaw
Microsoft issued an out-of-band .NET update for Brotli flaw CVE-2026-111497 (CVSS 8.1), preventing memory corruption or data leaks. It also resolves a Linux packaging flaw and provides patched releases across .NET 8 through 11.
Microsoft released an out-of-band .NET update on October 25 to fix Brotli flaw CVE-2026-111497, which allows out-of-bounds memory writes from malicious input. While ASP.NET Core and HttpClient calls may be affected, automatic decompression is off by default, and .NET Framework is unaffected. The patch also addresses Linux packaging flaw CVE-2026-114148 and releases .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3, requiring containers to be rebuilt.
Key takeaways
- Rated CVSS 8.1, CVE-2026-111497 allows out-of-bounds memory writes via malicious Brotli input; automatic decompression is off by default.
- Microsoft released patches across .NET 8 to 11; shared runtimes need a restart, while self-contained applications and containers require rebuilding.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.