Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Until the update can be deployed, avoid decompressing attacker-controlled Brotli data.

The following examples show how to disable Brotli decompression if you are already using it.

Warning: Do not use these code snippets if you are not already using decompression. Do not introduce a call to AddRequestDecompression if your application does not already call it. Similarly, do not introduce an AutomaticDecompression property assignment if your application does not already set that property. Modify only your existing decompression configuration. Enabling automatic decompression can introduce denial-of-service risks even when Brotli is excluded.

If you are already using Brotli request decompression in ASP.NET Core, exclude it by removing the br entry from your existing decompression configuration. This retains the default gzip and deflate providers:

builder.Services.AddRequestDecompression(options =>
{
    options.DecompressionProviders.Remove("br");
});

If your application already enables HttpClient automatic response decompression, disable Brotli by updating the flags on your existing handler so they do not include DecompressionMethods.Brotli:

var handler = new HttpClientHandler
{
    AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
};

var httpClient = new HttpClient(handler);

Applications that directly use Brotli decompression APIs must stop passing untrusted Brotli data to those APIs until updated. Ensure that other application code does not continue to decompress the same untrusted Brotli data. These changes can affect normal request and response handling and should be tested before deployment. Installing the security update remains the recommended fix.

<a name="affected-packages"></a>Affected Packages

The vulnerability affects .NET applications using an affected Brotli decoder in the runtime or NativeAOT packages listed below.

.NET 8

.NET 9