.NET October 2026 Out-of-Band Security Updates

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.

This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm. It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.

Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source.

For vulnerability details and affected products, see the linked security advisories.

Additionally, we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October 13, 2026 release did not fully address these issues. Today’s updates provide those fixes.

.NET 11 RC2 users should update to RC3 to receive these fixes.

You can check the runtimes installed on a machine with:

dotnet --list-runtimes

For framework-dependent deployments, confirm that the appropriate updated runtime listed above is installed. Self-contained applications and container deployments must be checked separately because they carry their own runtime.

See the .NET deployment documentation for more information about framework-dependent and self-contained applications.

If you encounter a problem after updating, report it in the .NET release feedback issues.