Sadeem IT Solutions
27 Oct 2026

Brotli flaw spreads: .NET and Python are now affected too

The critical Brotli flaw CVE-2026-111497 affects not only Node.js but also .NET and many Python applications. Microsoft has shipped emergency updates – here is how to check and protect your systems.

brotli-luecke-dotnet-python-cve-2026-111497

A few days ago we reported on Node2Shell, a critical flaw in the Brotli decoder of Node.js. It is now clear that the problem reaches much further. The vulnerability CVE-2026-111497 sits in Google's widely used Brotli compression library, which means it also affects .NET and many Python applications. Microsoft shipped out-of-band security updates for .NET on 25 October, and fixed packages are available for Python. If you run applications built on .NET or Python, now is the time to check and update.

What happened

Brotli is a method web servers and applications use to compress data. When decompressing specially crafted data, the library writes past the end of a memory buffer. Without logging in, an attacker can use this to read memory contents, crash programs and, under certain conditions, run their own code.

Brotli versions 1.0.3 through 1.2.0 are affected. The bug is fixed in 1.0.10, 1.1.1 and 1.2.1. Google rates the flaw CVSS 9.2 (CVSS 4.0, "critical"). Microsoft reportedly scores the .NET variant at 8.1 ("high"), because Brotli is not enabled by default there. Proof-of-concept exploits are public for Node.js, .NET and Python. As of 26 October, no attacks in the wild had been reported.

Timeline:

  • 21 October: Node.js publishes security releases.
  • 22 October: The flaw becomes public and the first exploits appear.
  • 23 October: Fixed Python packages are published on PyPI.
  • 25 October: Microsoft ships emergency updates for .NET 8, 9, 10 and 11.

Who is affected

.NET: Applications are at risk if they decompress Brotli data. This happens through request decompression in ASP.NET Core, automatic response decompression in HttpClient, or directly through the Brotli classes in System.IO.Compression. The first two features are off by default, but in practice they are often switched on. The classic .NET Framework is not affected.

Python: Here the situation is trickier. The popular libraries urllib3, and therefore requests, as well as httpx and aiohttp, automatically decompress Brotli responses as soon as the Brotli or brotlicffi package is installed. Your own code does not even need to use Brotli. It is enough for another package to have pulled it in as a dependency. A malicious or compromised server can then attack your application through its response, for example when you call APIs, receive webhooks or download files.

Other software: Brotli is also part of Linux distributions (Debian and Ubuntu have already released updates), Bun, Git for Windows and many other programs. Git for Windows includes the fix from version 2.56.0.windows.4.

What you should do now

  1. Update .NET to 8.0.33, 9.0.22 or 10.0.14, or .NET 11 RC 3. Run dotnet --list-runtimes to see which runtimes are installed.
  2. Rebuild self-contained applications. If an application ships its own .NET runtime, updating the server does not help. It must be rebuilt and redeployed.
  3. Rebuild containers. Recreate and roll out Docker images based on current .NET or Python images. Raise any pinned versions.
  4. Check Python environments: pip show Brotli brotlicffi tells you whether the packages are installed. Update to Brotli 1.2.1 or brotlicffi 1.2.1.0 and refresh your lock files (Poetry, uv, Pipenv). Tools such as pip-audit already detect the flaw.
  5. Patch Linux servers: Update your distribution's Brotli packages and restart the affected services.
  6. Prioritise: Start with applications that are reachable from the internet or fetch data from third-party servers.
  7. Keep end of support in mind: .NET 8 and .NET 9 receive no more updates after 10 November 2026. Use this opportunity to plan the move to .NET 10. Read more in our article on the end of support.

In the same release, Microsoft also fixed or re-issued fixes for two further flaws, including a privilege escalation on Linux (CVE-2026-114148). So the update pays off twice.

How Sadeem helps

We build and run custom software with .NET and Python and deal with dependency chains like this every day. We can check your applications, servers and containers for affected Brotli versions, apply the updates, rebuild images and test that everything still runs afterwards. With our managed hosting in Germany and the EU, we take care of updates, backups and monitoring on an ongoing basis, so you don't have to go hunting yourself when the next flaw appears.

Not sure whether your systems are affected? Get in touch for a free initial consultation.

Sources

Security.NETPythonNodeJSCVE