Red Hat Security Advisory: .NET 8.0 security update

Fixed packages 18

Vulnerabilities 2

• Critical 9.2
  CVE-2026-111497 Exploited Public exploit EPSS 83%

  Out-of-Bounds Write in Google Brotli Decoder

  A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

  Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
  Oct 22, 2026

  KEV Oct 27, 2026
• High 7.8
  CVE-2026-114148 Public exploit

  ASP.NET Core Elevation of Privilege Vulnerability

  Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

  Microsoft .NET 11.0 installed on Windows .NET 11.0 installed on Linux .NET 11.0 installed on Mac OS Linux Windows macOS Ubuntu Alpine
  Oct 29, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2558973
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2562054
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93455.json
• report
  https://access.redhat.com/security/cve/CVE-2026-111497
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-015
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-111497
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• article
  https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2026-114148
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-114148
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-114148