Emerging Threat: (CVE-2026-111497) .NET and ASP.NET Core Memory Corruption

Key facts

• CVE: CVE-2026-111497
• Component: Google Brotli decoder, as bundled in .NET 8, 9, 10 and 11 previews, Node.js, and other runtimes
• Severity: CVSS v4.0 9.2 (Critical) from Google as CNA; Microsoft rates the .NET exposure CVSS v3.1 8.1 (High)
• Impact: Unauthenticated memory read or corruption, leading to information disclosure, denial of service, or code execution
• Exposed .NET paths: ASP.NET Core request decompression with br, HttpClient automatic response decompression with Brotli, and direct use of BrotliStream or BrotliDecoder. None are on by default
• Fixed in: .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3. Brotli 1.0.10, 1.1.1, and 1.2.1
• Exploited in the wild: Yes. Added to the CISA Known Exploited Vulnerabilities catalog on 27 October 2026
• Not affected: .NET Framework

What is CVE-2026-111497?

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decompression library, in c/dec/decode.c. A crafted Brotli stream declares a single block type and then instructs the decoder to switch block types. Unpatched versions treat the malformed input as incomplete rather than invalid, keep decoding, and write past the end of the decoder’s buffer into adjacent state. Google assigned the CVE on 22 October 2026 and credited the discovery to OpenAI Codex Security.

The library is embedded in many runtimes, so the same flaw surfaces under several names. In Node.js, where the first code execution was demonstrated, it has been called Node2Shell. Microsoft shipped out-of-band updates for .NET on 25 October 2026 because .NET bundles the same decoder and exposes it through ASP.NET Core and HttpClient.

Google rates the library flaw at CVSS v4.0 9.2 (Critical). Microsoft rates the .NET exposure at CVSS v3.1 8.1 (High), with high attack complexity and no privileges or user interaction required. Red Hat also rates it 8.1 and notes that platform hardening such as address randomization raises the bar for reliable code execution.

In .NET the attacker needs the application to decompress Brotli data it controls. The advisory describes the outcome as the ability to read or corrupt process memory, which can lead to information disclosure, denial of service, or elevation of privilege. Reliable remote code execution has been demonstrated against Node.js in a controlled setup; for .NET, Microsoft has not published an exploitability assessment beyond the score.

Timeline

• 22 October 2026: Google publishes CVE-2026-111497 and releases Brotli 1.0.10, 1.1.1, and 1.2.1. Node.js ships fixes in 22.23.4, 24.22.1, and 26.12.1.
• 23 October 2026: Public proof-of-concept code produces crashes on unpatched decoders. Imperva reports code execution against an official Node.js 24.22.0 container image.
• 24 October 2026: Reports of the flaw being reachable through HTTP request bodies and automatic response decompression spread across the Node.js, Python, and Bun ecosystems.
• 25 October 2026: Microsoft publishes its advisory and releases .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3 out of band.
• 27 October 2026: CISA adds the CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of 10 November 2026.

Is CVE-2026-111497 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October 2026 and records exploitation as active. The observed activity so far has been reported against Node.js, which decompresses br request bodies by default in common frameworks such as Express 5 and decompresses br responses in fetch().

The picture is less settled on reliability. Imperva demonstrated code execution against a Node.js container after repeated attempts and has not released the exploit. Red Hat states that no public, reliable remote code execution proof of concept exists and that its own platforms mitigate the write with address randomization and compiler hardening. Crashes, which translate to denial of service for a worker process, are reproducible on any unpatched decoder.

No exploitation specific to .NET has been published at the time of writing. The decoder code is the same, so the distinction lies in reachability, which in .NET depends on configuration rather than defaults.

What assets are affected by CVE-2026-111497?

The affected component in .NET is the Brotli decoder shipped in the runtime and NativeAOT packages, on every platform and architecture. Affected releases are .NET 8 below 8.0.33, .NET 9 below 9.0.22, .NET 10 below 10.0.14, and .NET 11 previews before RC3. .NET Framework does not bundle the decoder and is unaffected.

An ASP.NET Core application is exposed when it has enabled request decompression and left the default br provider in place. An HTTP request with Content-Encoding: br is then decoded before the application sees it. A .NET service is also exposed when it calls out with HttpClient configured for automatic decompression including Brotli, since a malicious or compromised upstream can return a crafted response. The third path is application code that passes untrusted data to BrotliStream or BrotliDecoder, for example when unpacking uploaded archives or compressed payloads.

To an external scanner these assets look like any Kestrel or ASP.NET Core web application. The response headers show the server and framework, but nothing on the wire reveals whether request decompression is on. That makes the externally reachable population the starting point for the patch campaign, with the configuration check done from the inside.

What does our data show about exposure patterns?

Exposure in this set is led by Industrials at 25.2% of observed assets, with Information Technology at 18.9% and Communication Services at 14.1%. Health Care follows at 9.3%, and the remaining sectors together hold the rest.

The assets were identified by service fingerprint as running ASP.NET Core or its Kestrel web server. The fingerprint does not disclose the runtime patch level or whether Brotli request decompression is enabled, so the set describes where the affected runtime is reachable, not confirmed exploitability. Almost every observed asset is a named web application rather than a bare address.

Industrials leading the set fits how ASP.NET Core is deployed. Manufacturing, logistics, and commercial services run large numbers of line-of-business portals, customer and partner interfaces, and vendor-supplied applications on the Microsoft stack, often across acquired business units with their own hosting. Information Technology and Communication Services bring product front ends and APIs, where request decompression is more likely to have been switched on for bandwidth reasons.

Geographically, well over half of the observed assets resolve to the United States, followed by the Netherlands, Denmark, and Germany. For applications hosted on cloud platforms and behind content delivery networks, the recorded location reflects the hosting region rather than where the organization operates.

Are fixes available?

Yes. Microsoft released .NET 8.0.33, 9.0.22, 10.0.14, and 11.0.0 RC3 on 25 October 2026 as out-of-band security updates, and states that installing the update is the recommended fix. The same release re-issued fixes for CVE-2026-70197 and CVE-2026-102870, which the regular October update had not fully addressed, and fixed a Linux tarball ownership issue tracked as CVE-2026-114148.

How the update reaches an application depends on how it was deployed. Framework-dependent applications pick up the fix when the shared runtime on the host is updated and the process restarts. Self-contained and NativeAOT applications carry their own copy of the runtime and must be rebuilt and republished against the patched packages. Container images must be rebuilt from an updated base image and redeployed; pulling the base image first avoids a stale cache. dotnet --list-runtimes shows which runtimes a host has installed.

Outside .NET, the upstream fix is Brotli 1.0.10, 1.1.1, or 1.2.1. Node.js is fixed in 22.23.4, 24.22.1, and 26.12.1, while the 20.x and 25.x lines are end of life and receive no fix. Linux distributions are shipping updated brotli packages on their own schedules, and some trackers still listed releases as unfixed in the days after disclosure. Confirm the status with the vendor for each runtime in use.

Are there any other recommended actions to take?

Until the update is deployed everywhere, defenders should:

• Inventory ASP.NET Core applications that call AddRequestDecompression and check the provider list
• Remove the br provider from existing request decompression configuration
• Exclude DecompressionMethods.Brotli from any existing HttpClient automatic decompression settings
• Stop passing untrusted data to BrotliStream or BrotliDecoder until patched
• Reject Content-Encoding: br request bodies at the reverse proxy or load balancer
• Monitor for worker process crashes followed by unexpected child processes or outbound connections

Microsoft warns against adding decompression calls or AutomaticDecompression settings to applications that do not already have them, since enabling decompression introduces its own denial of service risk. Modify existing configuration only.

How can CyCognito help your organization?

CyCognito published an Emerging Threat Advisory for CVE-2026-111497 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.

To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.