The October 2026 Brotli Security Update: Who It Affects

Show Notes Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I'm your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem. This is a short bonus episode. There's no guest, and it isn't part of Bridging the Gap. It's a security note, and I didn't want it to wait for the next scheduled episode. Who This Is For I'll start with who this is for, so that nobody panics. It only matters if your code decompresses Brotli data that comes from outside your application. ASP.NET Core and HttpClient don't do that by default. So if you've never switched it on, and you never call the Brotli APIs yourself, this isn't about your application. Full Show Notes The full show notes, including links to some of the things we discussed and a full transcription of this episode, can be found at: https://dotnetcore.show/season-9/the-october-2026-brotli-security-update-who-it-affects/ Useful Links: The security update Microsoft Security Advisory CVE-2026-111497, including the full list of affected packages and Microsoft's mitigations .NET 8.0.33 release notes .NET 9.0.22 release notes .NET 10.0.14 release notes CVE-2026-111497 record, which lists the affected versions of the Brotli library .NET October 2026 Out-of-Band Security Updates, the .NET team's post, including what to do for self-contained applications and containers Microsoft Security Update Guide: CVE-2026-111497, Microsoft's severity rating and the full list of affected products CISA Known Exploited Vulnerabilities Catalog: CVE-2026-111497 Microsoft lifecycle pages, which are the authority on every support date in this episode .NET and .NET Core official support policy .NET Framework official support policy Related episodes S09E04 - .NET 8 and .NET 9 End of Support: What Stops, and What Does Not Get in touch with the show Getting in Touch: Via the contact page Joining the Discord Music created by Mono Memory Music, licensed to RJJ Software for use in The Modern .NET Show. Editing and post-production services for this episode were provided by MB Podcast Services.