A security update can be installed on a server without reaching the runtime an application actually uses. In .NET, the deployment model determines whether those two things move together.

That distinction matters when applying the October 25, 2026 out-of-band security update. Connecting where Brotli data is processed with where the runtime comes from makes the required work clearer.

Brotli decompression can happen in HTTP clients as well as incoming APIs

CVE-2026-111497 concerns a buffer overflow during Brotli decompression that may let an unauthenticated attacker read or corrupt process memory. It affects all platforms; .NET Framework is unaffected.

Inspect ASP.NET Core request decompression, HttpClient automatic response decompression, and the Brotli APIs in System.IO.Compression. Request and automatic response decompression are disabled by default, but application configuration and direct API usage still need examination.

In ASP.NET Core, AddRequestDecompression and UseRequestDecompression enable middleware that selects a provider using Content-Encoding. The value br identifies Brotli, and decompression happens when the request body is read. Following configuration through to body consumption helps identify the input path. Request decompression documentation

HttpClient's AutomaticDecompression instead handles responses to outgoing requests. A value other than None also adds the corresponding Accept-Encoding values to requests. This makes outbound service calls part of the inventory, alongside public API endpoints. AutomaticDecompression specification

Linux tarball exposure depends on the distribution artifact

Separately, CVE-2026-114148 concerns unsafe ownership metadata in Linux tarballs, potentially allowing local file modification and privilege escalation.

For .NET 10 and 11, the scope is source-build tarballs. For .NET 8 and 9, it also includes ASP.NET Core tarball distributions. Not building from source therefore does not establish that an installation is outside the scope.

Source-build consumers need refreshed artifacts and rebuilt packages; affected ASP.NET Core Runtime tarball installations need the refreshed tarball. Recording the installation artifact alongside the .NET release family helps distinguish these cases.

October 13 patching does not replace this update

Microsoft recommends updating as soon as possible. The October 25 releases are:

RC2 users should move to RC3. The update also completes October 13 fixes for CVE-2026-70197, involving SocketAsyncEventArgs memory corruption in .NET 8–11, and CVE-2026-102870, involving the Blazor WebAssembly debugger in .NET 10–11. Absence of Brotli usage alone does not justify skipping the whole update.

Shared and bundled runtimes require different deployment work

Framework-dependent applications use a runtime installed in their execution environment. Self-contained applications bundle one, so installing .NET on the host does not replace that copy. This deployment distinction explains why patching procedures differ. .NET publishing documentation

For a framework-dependent application, update its target runtime family and restart it. For a self-contained application, rebuild and republish with the patched runtime, then deploy the resulting artifact. Containers require rebuilding and redeployment using updated .NET images.

Build configuration is part of the work. RuntimeFrameworkVersion specifies the bundled runtime version for self-contained publishing, while rollForward set to Disable binds a framework-dependent application to its specified version. Where such settings exist, check that they permit the patched runtime to be selected. Runtime version selection rules

To list installed runtimes, use:

dotnet --list-runtimes

The list corresponds to the architecture of the invoked dotnet. In contrast, dotnet --version reports the SDK version. Neither a host inventory nor an SDK version establishes that bundled runtimes or separate containers have been updated. dotnet command documentation

The completion point is when each application starts using the fix, rather than when the download finishes. Trace Brotli inputs and tarball origins, apply the update through the appropriate deployment path, and verify startup and core application behavior. Treating these as one connected operation reduces gaps in runtime patching.

Source

• Title: .NET October 2026 Out-of-Band Security Updates
• URL: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/