Repository navigation
Does CVE-2026-111497 affect System.IO.Compression.Brotli in .NET 9 and 10? #136422
Description
Description
Can you confirm whether CVE-2026-111497 affects System.IO.Compression.Brotli in .NET 9.0.21 and 10.0.13? If it does, which runtime releases will contain the fix?
Reproduction Steps
Source inspection only; I have not run a crafted Brotli stream against .NET.
- ASP.NET Core’s BrotliDecompressionProvider creates a BrotliStream for Brotli request bodies.
- BrotliStream.Decompress calls BrotliDecoder.Decompress, which calls the native decoder.
- The vendored 10.0.13 decoder and 9.0.21 decoder appear to retain the pre-fix DecodeBlockTypeAndLength behavior.
Expected behavior
Malformed Brotli input should be rejected. Please confirm whether these runtime versions can reach the affected code path.
Actual behavior
The cited .NET decoder sources appear to contain the pre-fix logic. I have not confirmed exploitability or observed a crash in .NET.
Regression?
No response
Known Workarounds
No response
Configuration
No response
Other information
The upstream Google Brotli fix is google/brotli@0ed4268a4401abcb44720963.
Reacted by Steve Ognibene, Andrew Berezovskyi, Nicolai Birkmose Oksen, Alex Martossy, LorinWeilenmann, Oron Feinerman, valentin-pouget-forge, James Gurung and Sean Terry
Activity
dotnet-policy-service commentedon Oct 24, 2026
Tagging subscribers to this area: @karelz, @dotnet/area-system-io-compression
See info in area-owners.md if you want to be subscribed.
CodesInChaos commentedon Oct 24, 2026
The immediate fix should of course upgrade the C code. But I think it makes sense to switch the decoder (and perhaps the encoder as well) to a memory safe implementation (e.g. mbrotli written in rust), to prevent similar vulnerabilities in the future.
GrabYourPitchforks commentedon Oct 24, 2026
Hi all. We're aware of the CVE and appreciate your concern.
We're engaged with Microsoft's security response team to determine the extent of .NET's exposure here. We'll share a response plan broadly once we have more information.
GrabYourPitchforks commentedon Oct 25, 2026
Good morning all. Updates are now rolling out for supported .NET runtimes and SDKs through the normal distribution channels.
More information can be found at the following resources:
The patched builds are 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.
GrabYourPitchforks commentedon Oct 25, 2026
Reopening the issue just so we can track porting the fixes from our internal release branches into the public GitHub branches.
mmango10 commentedon Oct 25, 2026
Could you also confirm whether CVE-2026-111497 affects .NET 8.0.31? Our GitHub Actions self-hosted runner 2.338.0 bundles .NET 8.0.31 and libSystem.IO.Compression.Native.so (SHA-256: 05caac4d54c2447a9ede17477960120447f3bdd93517111b6ecab06a62d89caa). The vendored Brotli decoder source appears to retain the pre-fix block-switch behavior. Is this bundled runtime affected, and which supported .NET or runner release fixes it?
GrabYourPitchforks commentedon Oct 25, 2026
@mmango10 Please refer to the links I shared earlier.