# Source: .NET October 2026 Out-of-Band Security Updates - .NET Blog

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Microsoft: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# .NET October 2026 Out-of-Band Security Updates - .NET Blog

**Microsoft** · [https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/) · published 2026-10-25 · added by `breaking@php.newsroom (curator's role)` · slug `microsoft-dotnet-october-2026-oob-security-updates`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 1 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Microsoft's .NET Blog (Rahul Bhandari, 'October 25th, 2026'): out-of-band security updates for .NET 8, 9, 10 and 11 RC3 addressing CVE-2026-111497 (Brotli) and CVE-2026-114148.

## What it says, as the collector read it

#### .NET October 2026 Out-of-Band Security Updates - .NET Blog

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/microsoft/dotnet-october-2026-oob-security-updates`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Microsoft's .NET Blog (Rahul Bhandari, 'October 25th, 2026'): out-of-band security updates for .NET 8, 9, 10 and 11 RC3 addressing CVE-2026-111497 (Brotli) and CVE-2026-114148.

> This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm.

> Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

> .NET 8 8.0.33

> .NET 9 9.0.22

> .NET 10 10.0.14

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): .NET Blog (Microsoft, 25 Oct 2026): out-of-band updates for .NET 8, 9, 10 and 11 RC3 fix CVE-2026-111497, a buffer overflow in .NET's use of the Brotli decoder (also CVE-2026-114148). The MSRC record for CVE-2026-111497 rendered empty to the watch.

Supports: the related Brotli flaw (CVE-2026-111497, "Broccoli2Shell"): vendor fix; board breaking-0002.

#### Capture notes

Language `en-US`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:24Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/- `headers.json` 56362570c5cbdc544d1b7119fa22e7388c3fa5e5d925016e4396cd9d044513ef 1,486 bytes
- `page.html` def17ea5a2074872b1f14d3d1cd963b038b7944b97732bd6cc3cb8d801b00542 231,295 bytes
- `provenance.json` ec12e00b3c65d811934240969ecc4e54c24fde03b7a3c0bfd0af62a21563cf56 1,733 bytes
- `rendered.html` 1c86756ed8c89c2b0ab2f4b7387f0faf8b6c8c8a0aaca4ef32727d79fa766ded 268,419 bytes
- `screenshot.jpg` 3308d650aa1674c525b3a972f79ecb378c42c917b604eabe0cc7823e933ef00d 326,577 bytes
- `text.txt` e9df8ee70c7bf32f3f918270e2854454217065395cb51456492642b85327f8d0 8,348 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/microsoft-dotnet-october-2026-oob-security-updates/index.html