The October 2026 Brotli Security Update: Who It Affects
Om avsnittet
Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I'm your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem.
This is a short bonus episode. There's no guest, and it isn't part of Bridging the Gap. It's a security note, and I didn't want it to wait for the next scheduled episode.
Who This Is ForI'll start with who this is for, so that nobody panics. It only matters if your code decompresses Brotli data that comes from outside your application. ASP.NET Core and HttpClient don't do that by default. So if you've never switched it on, and you never call the Brotli APIs yourself, this isn't about your application.
Full Show NotesThe full show notes, including links to some of the things we discussed and a full transcription of this episode, can be found at: https://dotnetcore.show/season-9/the-october-2026-brotli-security-update-who-it-affects/
Useful Links:- The security update
- Microsoft Security Advisory CVE-2026-111497, including the full list of affected packages and Microsoft's mitigations
- .NET 8.0.33 release notes
- .NET 9.0.22 release notes
- .NET 10.0.14 release notes
- CVE-2026-111497 record, which lists the affected versions of the Brotli library
- .NET October 2026 Out-of-Band Security Updates, the .NET team's post, including what to do for self-contained applications and containers
- Microsoft Security Update Guide: CVE-2026-111497, Microsoft's severity rating and the full list of affected products
- CISA Known Exploited Vulnerabilities Catalog: CVE-2026-111497
- Microsoft lifecycle pages, which are the authority on every support date in this episode
- Related episodes
- Get in touch with the show
Music created by Mono Memory Music, licensed to RJJ Software for use in The Modern .NET Show.
Editing and post-production services for this episode were provided by MB Podcast Services.
Fler avsnitt
Visa alla avsnitt av The Modern .NET ShowThe Modern .NET Show med Jamie Taylor finns tillgänglig på flera plattformar. Informationen på denna sida kommer från offentliga podd-flöden.