Broccoli2Shell (CVE-2026-111497): What the Microsoft .NET Brotli RCE Means for Your Cloud Workloads
Executive Summary
In October 2026, Microsoft issued emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library dubbed Broccoli2Shell (also tracked as HTTP2Shell and Node2Shell). The flaw allows unauthenticated remote attackers to trigger crashes, memory leaks, or achieve remote code execution by sending maliciously crafted Brotli-compressed streams to any application using ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs. Proof-of-concept exploit code was publicly available on GitHub at time of disclosure, significantly lowering the bar for exploitation across enterprise cloud-hosted and on-premises .NET workloads.
The public availability of PoC exploit code for a critical RCE vulnerability in a foundational compression library used across millions of .NET applications signals a narrow remediation window for security teams. Organizations with internet-facing APIs, microservices, or cloud-native applications built on .NET are at elevated risk, and the attack surface is amplified by the broad adoption of HTTP/2 and Brotli compression in modern cloud environments.
Why This Matters Now
With PoC exploits already published on GitHub and no default safeguards blocking Brotli-compressed requests at the network layer, organizations running unpatched .NET workloads face an immediate and concrete risk of remote code execution. Cloud-native environments with high volumes of HTTP/2 traffic and microservices architectures are especially exposed, and attackers can weaponize this vulnerability before most patch cycles complete.
Attack Path Analysis
An attacker targets internet-facing .NET applications that have opted into Brotli decompression (ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs), sending a maliciously crafted Brotli-compressed stream to exploit CVE-2026-111497 and achieve remote code execution or memory corruption on the vulnerable host. From that initial foothold, the attacker leverages the RCE capability to escalate privileges on unpatched .NET installations running non-default configurations, then moves laterally across cloud workloads and internal services, establishes command-and-control channels, exfiltrates sensitive data, and ultimately disrupts or destroys targeted services.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker sends a specially crafted Brotli-compressed HTTP request to an internet-exposed ASP.NET Core application or HTTP client that has opted into Brotli decompression. The out-of-bounds write in the Brotli decoder (CVE-2026-111497) triggers a memory corruption condition, enabling remote code execution on the vulnerable .NET host. Public PoC exploits published on GitHub lower the barrier to exploitation significantly.
Related CVEs
CVE-2025-21172
CVSS 7.5A critical out-of-bounds write vulnerability in the Brotli decoder used by .NET and Visual Studio allows a remote unauthenticated attacker to trigger memory corruption, crashes, or achieve remote code execution by sending a maliciously crafted Brotli-compressed data stream to affected applications.
Affected Products:
Microsoft .NET 8 – < 8.0.12
Microsoft .NET 9 – < 9.0.1
Microsoft Visual Studio 2022 – < 17.12.4
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Client Execution
Exploitation for Defense Evasion
Exploitation for Privilege Escalation
Endpoint Denial of Service: Application or System Exploitation
Command and Scripting Interpreter
Ingress Tool Transfer
Obtain Capabilities: Vulnerabilities
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
PCI DSS 4.0 – All System Components Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
DORA (EU) 2022/2554 – ICT Risk Management and Vulnerability Handling
Control ID: Article 9 – ICT Security
NIS2 Directive (EU) 2022/2555 – Vulnerability Handling and Patch Management
Control ID: Article 21 – Cybersecurity Risk Management Measures
CISA ZTMM 2.0 – Application-Level Vulnerability and Dependency Management
Control ID: Application Workloads – Pillar 4, Optimize Stage
NYDFS 23 NYCRR 500 – Vulnerability Management and Privilege Escalation Prevention
Control ID: Section 500.7 – Access Privileges and Section 500.16 – Vulnerability Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical CVE-2026-111497 Brotli RCE flaw directly threatens .NET-dependent IT infrastructure; unpatched ASP.NET Core deployments face remote code execution and privilege escalation via maliciously crafted compressed streams.
Financial Services
Financial platforms leveraging .NET HTTP clients for encrypted data transit face RCE and exfiltration risk; PCI 4.0 and NIST.800-53.SC-7 compliance gaps emerge if Brotli decompression remains unpatched.
Health Care / Life Sciences
Healthcare .NET applications processing compressed data streams risk patient data exfiltration and privilege escalation, threatening HIPAA.164.312(e)(1) and HIPAA.164.308(a)(1) compliance through vulnerable Brotli decoder exploitation.
Computer Software/Engineering
Software engineering teams bundling Brotli libraries independently of system updates remain exposed post-patch; PoC exploits published on GitHub accelerate lateral movement and initial compromise risk across development pipelines.
Sources
- Microsoft releases emergency .NET patches for critical Brotli flawhttps://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/Verified
- CVE-2025-21172 Detail - NVDhttps://nvd.nist.gov/vuln/detail/CVE-2025-21172Verified
- Microsoft Security Advisory CVE-2025-21172 - .NET and Visual Studio Remote Code Execution Vulnerabilityhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172Verified
- .NET January 2025 Updates - Microsoft DevBlogshttps://devblogs.microsoft.com/dotnet/dotnet-january-2025-updates/Verified
- Critical HTTP2Shell Brotli vulnerability triggers emergency patches - BleepingComputerhttps://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/Verified
- Google Brotli Library - GitHub Advisoryhttps://github.com/google/brotli/security/advisoriesVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attack chain depends on unrestricted inbound reachability to vulnerable .NET workloads, uncontrolled east-west trust between cloud services, and open outbound egress paths for command-and-control and data exfiltration. By enforcing workload-level segmentation, identity-aware routing, and controlled egress, CNSF would likely reduce the attacker's ability to pivot freely and exfiltrate data even after initial exploitation.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Restricting inbound reachability to only explicitly authorized source paths and ports would likely reduce the attack surface available to unauthenticated internet-originating exploit traffic targeting the vulnerable .NET endpoint.
Control: Zero Trust Segmentation
Mitigation: Workload-level Zero Trust segmentation would likely constrain what a compromised unprivileged process can communicate with, reducing the practical value of harvested credentials by limiting where those credentials could be used to move next.
Control: East-West Traffic Security
Mitigation: Enforcing east-west microsegmentation between workloads would likely reduce the attacker's ability to freely pivot from the initially compromised .NET host to adjacent microservices or internal APIs, limiting lateral reachability across application tiers.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility into outbound traffic patterns from .NET workloads would likely surface anomalous communication flows to unexpected external destinations, reducing the attacker's ability to maintain covert command-and-control channels without detection.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based egress policy enforcement would likely constrain outbound data transmission to only approved external destinations, reducing the attacker's ability to exfiltrate sensitive data to unauthorized external infrastructure.
If earlier CNSF controls meaningfully limited lateral movement and egress paths, the attacker's blast radius at the Impact stage would likely be constrained to a smaller set of workloads rather than extending across interconnected cloud services and application tiers.
Impact at a Glance
Affected Business Functions
- Web Application Services (ASP.NET Core HTTP request decompression)
- API Gateway and Microservices Communication
- Software Development and Build Pipelines (Visual Studio, .NET SDK)
- Cloud-Hosted Application Delivery and Content Distribution
Estimated downtime: 3 days
Estimated loss: N/A
No confirmed data exfiltration reported at time of publication. However, successful exploitation of this out-of-bounds write vulnerability could expose application memory contents including session tokens, cryptographic keys, PII processed in-memory by web applications, and internal service credentials. Applications using ASP.NET Core request decompression or HttpClient response decompression with Brotli enabled are at highest risk of memory leakage leading to sensitive data disclosure.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Microsoft's emergency OOB patches for .NET 8, 9, 10, and 11 RC3 immediately; audit all application deployments for bundled Brotli libraries that are not addressed by OS-level updates, and use the CNSF Cloud Firewall (ACF) or inline proxy to block incoming Brotli-compressed requests at the network edge for any workloads that cannot be patched immediately.
- • Deploy Inline IPS (Suricata) with updated signatures for CVE-2026-111497 exploit traffic patterns to detect and block maliciously crafted Brotli-compressed streams before they reach vulnerable .NET application endpoints, reducing the Initial Compromise attack surface.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation policies to restrict workload-to-workload trust and prevent lateral movement from any compromised .NET service; apply least-privilege access controls so that a single compromised workload cannot reach adjacent cloud services or retrieve cloud metadata credentials.
- • Activate Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls on all cloud workloads running .NET applications to prevent established C2 communications and unauthorized data exfiltration to attacker-controlled destinations following a successful exploit.
- • Enable Multicloud Visibility & Control to baseline normal traffic patterns for .NET application workloads and generate alerts on anomalous HTTP/2 Brotli traffic volumes, unexpected outbound connections, or suspicious privilege escalation events, ensuring rapid detection and response if exploitation occurs before patching is complete.
