Microsoft .NET, jumladan Brotli bufer to'lib ketishi va avvalgi oktyabr oyidagi yangilanishlarning to'liq tuzatilmagan kamchiliklari bilan bog'liq to'rtta zaiflikni bartaraf etish uchun shoshilinch tarzda (out-of-band) xavfsizlik yangilanishlarini chiqardi.
Yangilanishlar .NET 8, .NET 9, .NET 10 va .NET 11 Release Candidate 3 ga taalluqli. Microsoft iloji boricha tezroq yangilanishni tavsiya qiladi.
CVE-2026-111497 .NET'ning Brotli dekompressiya (siqishni ochish) amalga oshirishiga ta'sir qiladi va barcha platformalarda uchraydi. Bu bufer to'lib ketishi zaifligi autentifikatsiyadan o'tmagan hujumchiga jarayon xotirasini o'qish yoki buzish imkonini berishi mumkin, bu esa ma'lumot oshkor bo'lishi, xizmatdan foydalanishni rad etish (DoS) yoki huquqlarni oshirishga olib kelishi mumkin.
Ilovalar Brotli bilan siqilgan ma'lumotlarni qayta ishlaganda xavf ostida qolishi mumkin — masalan, ASP.NET Core so'rovlarini dekompressiya qilish, HttpClient'dagi avtomatik javob dekompressiyasi yoki System.IO.Compression Brotli API'laridan foydalanish orqali.
Biroq, so'rov dekompressiyasi va avtomatik javob dekompressiyasi sukut bo'yicha yoqilmagan. Microsoft bu muammo .NET Framework'ga ta'sir qilmasligini tasdiqladi.
Ikkinchi zaiflik, CVE-2026-114148, Linux uchun .NET tarballaridagi xavfsiz bo'lmagan egalik (ownership) metama'lumotlari bilan bog'liq. Mahalliy hujumchi ta'sirlangan o'rnatishlarda fayllarni o'zgartirib, yuqori huquqlarga ega bo'lishi mumkin.
.NET 10 va .NET 11 uchun bu muammo faqat manba (source) qurilish tarballariga ta'sir qiladi. .NET 8 va .NET 9 uchun esa ta'sir ASP.NET Core tarballari orqali o'rnatilgan ASP.NET Core tarqatishlarini ham o'z ichiga oladi, bu esa .NET'ni manbadan qurmaydigan o'rnatishlarga ta'sir qiladi.
Microsoft shuningdek, 2026-yil 13-oktyabrda chiqarilgan yangilanishlar asosiy zaifliklarni to'liq bartaraf etmagani sababli ikkita maslahatni qayta e'lon qildi. CVE-2026-70197 SocketAsyncEventArgs bilan bog'liq xotira buzilishi (memory corruption) bilan bog'liq va .NET 8, .NET 9, .NET 10 va .NET 11 ga ta'sir qiladi.
CVE-2026-102870 Blazor WebAssembly debugger'iga tegishli va .NET 10 hamda .NET 11 ga ta'sir qiladi. So'nggi chiqarilishlar endi bu ikkala muammoning ham tuzatishlarini o'z ichiga oladi.
Tuzatilgan chiqarilishlar: .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 va .NET 11 Release Candidate 3. Hozirda .NET 11 RC2 dan foydalanayotgan dasturchilar bu tuzatishlarni olish uchun RC3 ga yangilanishlari kerak.
Framework-ga bog'liq ilovalar (framework-dependent applications) uchun yangilangan runtime'ni o'rnating, so'ngra ilovani qayta ishga tushiring. O'z-o'zini o'z ichiga olgan ilovalar (self-contained applications) esa qayta qurilishi va qayta nashr etilishi kerak, chunki yangi host runtime'ni o'rnatish o'rnatilgan (bundled) runtime'ni almashtirmaydi.
Konteyner o'rnatishlari yangilangan .NET tasvirlari bilan qayta qurilishi va qayta joylashtirilishi kerak. Manba qurilishlaridan (source builds) foydalanadigan foydalanuvchilar yangilangan artefaktlarni olishlari va paketlarini qayta qurishlari lozim.
Bundan tashqari, .NET 8 va .NET 9 da ASP.NET Core tarball foydalanuvchilari, manbadan qurish yoki qurmasligidan qat'i nazar, yangilangan runtime tarballarini o'rnatishlari kerak.
Administratorlar o'rnatilgan runtime'larni dotnet –list-runtimes buyrug'i yordamida tekshirishlari mumkin. Biroq, o'z-o'zini o'z ichiga olgan ilovalar va konteynerlar alohida tekshirishni talab qiladi, chunki ularning har biri o'z runtime'ini o'z ichiga oladi va host o'rnatishiga tayanmaydi.
Microsoft released emergency out-of-band security updates addressing four vulnerabilities across .NET, including a Brotli buffer overflow and incomplete fixes from an earlier October release.
The updates apply to .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft recommends updating as soon as possible.
CVE-2026-111497 affects .NET’s implementation of Brotli decompression across all platforms. This buffer overflow vulnerability could let an unauthenticated attacker read or corrupt process memory, potentially leading to information disclosure, denial of service, or privilege escalation.
Applications could be at risk when processing Brotli-compressed data through features such as ASP.NET Core request decompression, automatic response decompression in HttpClient, or using System.IO.Compression Brotli APIs.
However, request decompression and automatic response decompression are not enabled by default. Microsoft has confirmed that this issue does not affect the .NET Framework.
The second vulnerability, CVE-2026-114148, pertains to unsafe ownership metadata in .NET tarballs for Linux. A local attacker could exploit affected installations to modify files and gain elevated privileges.
For .NET 10 and .NET 11, this issue affects only source-build tarballs. For .NET 8 and .NET 9, the exposure also includes ASP.NET Core distributions installed through ASP.NET Core tarballs, which affects deployments that do not build .NET from source.
Microsoft also reissued two advisories because the updates released on October 13, 2026 did not fully resolve the underlying vulnerabilities. CVE-2026-70197 involves memory corruption with SocketAsyncEventArgs and affects .NET 8, .NET 9, .NET 10, and .NET 11.
CVE-2026-102870 relates to the Blazor WebAssembly debugger and impacts .NET 10 and .NET 11. The latest releases now include fixes for both of these issues.
The patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3. Developers currently using .NET 11 RC2 must upgrade to RC3 to receive these fixes.
For framework-dependent applications, install the updated runtime, then restart the application. In contrast, self-contained applications need to be rebuilt and republished because installing a newer host runtime does not replace the bundled runtime.
Container deployments require rebuilding and redeploying with updated .NET images. Users who rely on source builds must obtain refreshed artifacts and rebuild their packages.
Additionally, ASP.NET Core tarball users on .NET 8 and .NET 9 must install the refreshed runtime tarballs, regardless of whether they compile from source.
Administrators can check the installed runtimes using the command dotnet –list-runtimes. However, self-contained applications and containers require separate verification because each one carries its own runtime instead of relying on the host installation.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.