Out-of-band .NET security releases published October 25, 2026; Azure App Service rollout update October 26, 2026
Microsoft Ships an Emergency .NET Update for a Critical Brotli Flaw, CVE-2026-111497
Microsoft released out-of-band security updates on October 25 for a critical flaw in the Brotli decoder used by .NET and ASP.NET Core, CVE-2026-111497, an out-of-bounds write where processing maliciously crafted compressed data could result in denial of service, information disclosure, or elevation of privilege. The patched releases are .NET 8.0.33, .NET 9.0.22, and .NET 10.0.14, with coverage also reported for .NET 11 Release Candidate 3, across Windows, macOS, and Linux, and .NET Framework is not affected. Applications can be affected when they use Brotli decompression through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs, and Microsoft notes automatic request and response decompression are not enabled by default. The same release also fixes a Linux .NET tarball ownership issue, CVE-2026-114148. Azure App Service said on October 26 that updated built-in runtimes for Windows were rolling out through Safe Deployment Practices with the rollout in progress, not complete, and that self-contained deployments and custom containers must be rebuilt by their owners.
Executives
Out-of-band means Microsoft judged this too urgent for the monthly cycle. The exposure sits in a compression library, the kind of shared component that hides inside many applications at once, so the right question is not whether one server was patched but how your teams prove every deployment type, hosted, self-contained, and containerized, is running a fixed runtime.
CIO / CISO
Sequence by data flow: applications that decompress request bodies or responses from untrusted sources go first. Require teams to verify the running application process, not the SDK version or the configured release line, and treat Azure App Service's in-progress rollout as unproven for any individual app until its logs show the patched runtime version.
Engineers
Move to .NET 8.0.33, 9.0.22, or 10.0.14 for your release line and restart the application. Rebuild and redeploy self-contained apps and container images yourself, because a host runtime update does not replace a bundled runtime. Check whether Brotli decompression is enabled in your configuration, review the separate tarball ownership fix if you install from Linux tarballs, and avoid exposing runtime diagnostics on an unauthenticated endpoint while you verify.
Everyone (non-IT)
Nothing here asks individual users to act. If your work software restarts or updates this week, this emergency fix is a likely reason, and letting it complete is the contribution that matters.