# Microsoft parchea .NET y PowerShell por Brotli

DevFeed: [Microsoft parchea .NET y PowerShell por Brotli](<https://devfeed.tech/articles/microsoft-parchea-net-y-powershell-por-brotli-105305.md>)

Original publisher: [Read original article](<https://observatorioblockchain.com/ciberseguridad/dotnet-parche-fuera-de-banda-brotli/>)

Author: José Maldonado

Published: 2026-10-28T18:00:47Z

Content type: news

Language: es

Sources: [Observatorio Blockchain](<https://devfeed.tech/sources/observatorio-blockchain.md>)

Topics: [.NET](<https://devfeed.tech/topics/net.md>), [PowerShell](<https://devfeed.tech/topics/powershell.md>), [ASP.NET Core](<https://devfeed.tech/topics/asp-net-core.md>), [.NET Framework](<https://devfeed.tech/topics/net-framework.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [asp-net-core](<https://devfeed.tech/tags/asp-net-core.md>), [blazor](<https://devfeed.tech/tags/blazor.md>), [brotli](<https://devfeed.tech/tags/brotli.md>), [ciberseguridad](<https://devfeed.tech/tags/ciberseguridad.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-111497](<https://devfeed.tech/tags/cve-2026-111497.md>), [cve-2026-114148](<https://devfeed.tech/tags/cve-2026-114148.md>), [cvss](<https://devfeed.tech/tags/cvss.md>), [google](<https://devfeed.tech/tags/google.md>), [linux](<https://devfeed.tech/tags/linux.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [nativeaot](<https://devfeed.tech/tags/nativeaot.md>), [net](<https://devfeed.tech/tags/net.md>), [net-10](<https://devfeed.tech/tags/net-10.md>), [net-8](<https://devfeed.tech/tags/net-8.md>), [net-framework](<https://devfeed.tech/tags/net-framework.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [php](<https://devfeed.tech/tags/php.md>), [php2shell](<https://devfeed.tech/tags/php2shell.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [seguridad](<https://devfeed.tech/tags/seguridad.md>), [software](<https://devfeed.tech/tags/software.md>), [tecnologia](<https://devfeed.tech/tags/tecnologia.md>)

## AI overview

Microsoft released out-of-band .NET 8.0.33, 9.0.22, 10.0.14 and 11 RC3 to address CVE-2026-111497, a Brotli decoder buffer overflow. Exploitation requires control of compressed data reaching the decoder; the article says exposure routes include ASP.NET Core request decompression, automatic HttpClient response decompression, and System.IO.Compression Brotli APIs, with the first two disabled by default. The releases also address a Linux tarball permissions flaw in .NET 8 and 9 and republish fixes for two October advisories, including a BrowserDebugHost packaging correction; users who applied the October 13 patches are advised to update again. Updating the machine runtime does not replace runtimes bundled with self-contained apps, NativeAOT binaries, containers, or PowerShell installations, so those need rebuilding, redeployment, or a PowerShell version upgrade. Running processes must restart to load updated libraries. The article reports no confirmed real-world exploitation and notes .NET 8 and 9 support ends November 10, 2026.

## Source excerpt

Microsoft publica el 25 de octubre .NET 8.0.33, 9.0.22 y 10.0.14 fuera de banda por el fallo crítico de Brotli y republica dos avisos de octubre.