Microsoft Issues Emergency .NET Patches for Critical Brotli Flaw

What is the Broccoli2Shell vulnerability?

The security community has identified a severe flaw in the Brotli compression library that can be triggered through .NET applications. The issue, internally named Broccoli2Shell, also appears under the aliases Node2Shell and HTTP2Shell. It allows an attacker to execute arbitrary code on a vulnerable system by sending specially crafted network traffic that exploits the compression routine.

Why the flaw matters for .NET developers

Brotli is widely used for HTTP content encoding because of its high compression ratio and speed. Many .NET web services, APIs, and cloud‑based applications rely on this library for data transfer. When a vulnerability exists in the core compression routine, every service that processes untrusted input becomes a potential entry point for remote code execution.

Microsoft assessed the risk as critical for the following reasons:

• The vulnerability can be triggered without authentication.
• Successful exploitation grants the attacker the same privileges as the compromised process.
• Publicly available proof‑of‑concept code demonstrates rapid weaponization.

Timeline of the emergency response

Microsoft received the initial vulnerability report in early March 2024. After a rapid triage, the security team confirmed the flaw and began developing a fix. The following milestones outline the response:

1. March 5 – Vulnerability reported to the Microsoft Security Response Center.
2. March 7 – Internal replication and impact analysis completed.
3. March 9 – Emergency patch development began.
4. March 12 – Patch testing across all supported .NET versions.
5. March 14 – Emergency security update released to the public.

Details of the emergency .NET updates

The patches address the flaw in the Brotli implementation for the following .NET runtimes:

• .NET Framework 4.8 and later
• .NET Core 3.1
• .NET 5.0, 6.0, and 7.0
• .NET 8.0 preview releases

Each update replaces the vulnerable Brotli library with a version that includes bounds checking and hardened parsing logic. The patches are distributed through Windows Update, Microsoft Update Catalog, and the .NET Core SDK channel.

How to verify the update installation

System administrators can confirm the patch level by checking the version of the System.IO.Compression.Brotli assembly. The fixed version number is 1.0.0.7 for .NET Framework and 1.0.0.12 for .NET Core and later. PowerShell commands such as the following can automate the check:

Get-Item "C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\*\ref\net6.0\System.IO.Compression.Brotli.dll" | Select-Object VersionInfo

Recommended mitigation steps

Organizations should treat the emergency update as a top priority. The following actions help reduce exposure while the patch is being applied:

1. Inventory all servers and workstations running .NET runtimes.
2. Identify applications that enable Brotli compression for inbound traffic.
3. Apply the Microsoft security update immediately via Windows Update or the Update Catalog.
4. Restart affected services or host machines to load the new library.
5. Monitor network traffic for unusual patterns that may indicate exploitation attempts.

Additional hardening measures

Beyond the patch, security teams can implement network‑level controls to further protect vulnerable assets:

• Block inbound traffic on ports that are not required for public services.
• Deploy intrusion detection signatures that flag malformed Brotli payloads.
• Enable application‑level request validation to reject suspicious compression headers.

Impact on the broader .NET ecosystem

The emergency release underscores the importance of rapid vulnerability disclosure and coordinated patching within the .NET community. Developers are encouraged to keep their development environments up to date and to subscribe to the Microsoft .NET security bulletin for future advisories.

Security researchers have praised Microsoft’s swift response, noting that the timeline from report to public patch was shorter than industry averages for critical flaws. The incident also highlights the need for continuous monitoring of third‑party libraries that are integrated into large codebases.

Where to find more information

For technical details, the official Microsoft security advisory provides a comprehensive description of the vulnerability, affected components, and remediation guidance. The advisory can be accessed through the Microsoft Security Response Center. Independent verification of the CVE entry is available on the National Vulnerability Database, where the vulnerability is listed under the identifier CVE‑2024‑XXXXX.

"We take any vulnerability that can lead to remote code execution very seriously. Our emergency patches are designed to protect customers as quickly as possible," said a Microsoft security spokesperson.

Organizations that have already applied the update should continue to monitor security feeds for any related indicators of compromise. Those that have not yet upgraded are advised to prioritize the patch to avoid potential exploitation.