.NET October 2026 out-of-band security updates: Brotli and tarball ownership

Microsoft shipped out-of-band security updates for .NET 8, 9, 10 and .NET 11 RC3. CVE-2026-111497 fixes a Brotli decompression buffer overflow, and CVE-2026-114148 fixes unsafe ownership metadata in Linux tarballs. Two earlier fixes that the October 13 release missed were also re-shipped. Rebuilding self-contained apps and container images is required to pick up the fix.

Key points

• Updated versions: .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 RC3; RC2 users should move to RC3.
• CVE-2026-111497 affects all platforms, but exposure depends on using Brotli decompression features that are off by default.
• Framework-dependent apps need the updated runtime installed and a restart.
• Self-contained apps and container images carry their own runtime, so rebuild, republish and redeploy them.
• Check installed runtimes with dotnet --list-runtimes.
• ASP.NET Core tarball users on .NET 8 and 9 must install the refreshed tarball even if they do not build from source.

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, alongside .NET 11 Release Candidate 3. The main fix addresses a buffer overflow in .NET's Brotli decompression code (CVE-2026-111497), which could let an unauthenticated attacker read or corrupt process memory. A second issue (CVE-2026-114148) affects Linux .NET tarballs, where unsafe ownership metadata could let a local user modify files and gain elevated privileges.

You are exposed to the Brotli issue only if your app decompresses Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs, since none of those are on by default. The tarball issue hits source-build tarballs on .NET 10 and 11, and also ASP.NET Core tarballs on .NET 8 and 9. The October 13 release left gaps in the SocketAsyncEventArgs and Blazor WebAssembly debugger fixes, so those are re-shipped too. .NET Framework is not affected.

Real-world use

• An ASP.NET Core API that accepts Brotli-compressed request bodies, where request decompression is enabled.
• A service calling external APIs with HttpClient automatic decompression turned on.
• Linux build agents or servers installed from source-build or tarball packages that need the ownership fix.

Why it matters

Check whether your apps use Brotli decompression, then update runtimes, rebuild self-contained apps, and redeploy container images. Installing a runtime on the host alone does not fix bundled copies.

Related stories

• A secure enterprise chat with React, .NET 10 and Microsoft FoundryDVDEV Community: #dotnet1 d ago
• ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It SafelyDVDEV Community: #aspnetcore1 d ago
• Mastering Rate Limiting and Resource Governance for MCP Servers at ScaleDVDEV Community: #aspnetcore1 d ago