Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google’s widely used Brotli lossless compression algorithm.
HTTP2Shell impacts HTTP clients and servers, as well as other applications and tools that rely on vulnerable Brotli implementations.
Successful exploitation lets unprivileged attackers use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries.
According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.
“Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs,” Microsoft said.
“Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET.”
To address this flaw, Microsoft has released out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3, and advised “updating as soon as possible.”
While proof-of-concept (PoC) exploits for Broccoli2Shell have already been published on GitHub, no reports of malicious exploitation in the wild have emerged.
A dedicated online portal tracking the flaw warns that updating the system Brotli library doesn’t address the risk in apps that bundle their own copy of the library.
Those who can’t apply the updates immediately should block incoming Brotli-compressed requests using a proxy or firewall, or disable Brotli decoding until they can apply a patch.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
