<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8" -->

---
title: .NET October 2026 Out-of-Band Security Updates | daily.dev
description: Out-of-band security updates shipped for .NET 8, 9, 10, and .NET 11 Release Candidate 3. The release fixes CVE-2026-111497, a vulnerability in the Brotli...
canonical: https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: .NET October 2026 Out-of-Band Security Updates | daily.dev
og:description: Out-of-band security updates shipped for .NET 8, 9, 10, and .NET 11 Release Candidate 3. The release fixes CVE-2026-111497, a vulnerability in the Brotli...
og:url: https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8
og:image: https://api.daily.dev/og/posts/O7mFuKCd8.png
og:image:alt: .NET October 2026 Out-of-Band Security Updates
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# .NET October 2026 Out-of-Band Security Updates

**[DevBlogs](https://daily.dev/sources/devblogs)** · 3 min read · 9 upvotes · 0 comments

## Summary

Out-of-band security updates shipped for .NET 8, 9, 10, and .NET 11 Release Candidate 3. The release fixes CVE-2026-111497, a vulnerability in the Brotli decompression algorithm, and CVE-2026-114148, a Linux tarball ownership issue. For .NET 8 and 9, the tarball issue also affects ASP.NET Core tarball distributions, not just source-build users. The update also re-releases fixes for CVE-2026-70197 and CVE-2026-102870 because the October 13, 2026 release didn't fully resolve them. Updated versions are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates>

## Questions this post answers

### What does CVE-2026-111497 affect in .NET and how is it fixed?

CVE-2026-111497 is a vulnerability in the Brotli decompression algorithm affecting .NET. It can impact applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected. It's fixed in .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3.

_Teams tracking Brotli-related CVEs can follow .NET security patch news on daily.dev._

### Does the Linux .NET tarball ownership vulnerability CVE-2026-114148 affect binary distributions or only source builds?

For .NET 10 and 11, CVE-2026-114148 only affects source-build tarballs. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who never build .NET from source. Fixed versions are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3, which replaces RC2.

_Developers patching Linux .NET deployments can keep up with tarball CVE fixes on daily.dev._

### Why did Microsoft re-release fixes for CVE-2026-70197 and CVE-2026-102870 after the October 13, 2026 .NET update?

The October 13, 2026 release did not fully address CVE-2026-70197, a SocketAsyncEventArgs memory corruption issue in .NET 8, 9, 10, and 11, and CVE-2026-102870, a Blazor WebAssembly debugger issue in .NET 10 and 11. Microsoft issued complete fixes for both in this out-of-band update, delivered in .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3.

_Anyone verifying a prior .NET patch actually closed a CVE can track follow-up fixes on daily.dev._

## Similar posts on daily.dev

- [.NET and .NET Framework September 2026 servicing releases updates](https://daily.dev/posts/net-and-net-framework-september-2026-servicing-releases-updates-tekcucbuk) · .NET Blog · 5 upvotes · 1 comments
- [.NET and .NET Framework July 2026 servicing releases updates](https://daily.dev/posts/net-and-net-framework-july-2026-servicing-releases-updates-5q6ye2knz) · DevBlogs · 9 upvotes · 0 comments
- [.NET and .NET Framework May 2026 servicing releases updates](https://daily.dev/posts/net-and-net-framework-may-2026-servicing-releases-updates-l2lyomuhk) · ASP.NET Blog · 49 upvotes · 2 comments
- [.NET and .NET Framework June 2026 servicing releases updates](https://daily.dev/posts/net-and-net-framework-june-2026-servicing-releases-updates-efwa2y70w) · .NET Blog · 7 upvotes · 1 comments
- [.NET and .NET Framework March 2026 servicing releases updates](https://daily.dev/posts/net-and-net-framework-march-2026-servicing-releases-updates-prjisr5bq) · DevBlogs · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#.net](https://daily.dev/tags/.net), [#aspnetcore](https://daily.dev/tags/aspnetcore)

[View this post on daily.dev](https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":".NET October 2026 Out-of-Band Security Updates","url":"https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8"},"datePublished":"2026-10-25T18:46:01.462Z","dateModified":"2026-10-25T18:46:36.049Z","description":"Out-of-band security updates shipped for .NET 8, 9, 10, and .NET 11 Release Candidate 3. The release fixes CVE-2026-111497, a vulnerability in the Brotli...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28cc701b658ae224ff970de1f8a1e223?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28cc701b658ae224ff970de1f8a1e223?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevBlogs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevBlogs","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8f68b453325f482ebeb73fb780092713","url":"https://daily.dev/sources/devblogs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,.net,aspnetcore","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevBlogs","item":"https://daily.dev/sources/devblogs"},{"@type":"ListItem","position":3,"name":".NET October 2026 Out-of-Band Security Updates"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/net-october-2026-out-of-band-security-updates-o7mfukcd8#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-111497 affect in .NET and how is it fixed?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-111497 is a vulnerability in the Brotli decompression algorithm affecting .NET. It can impact applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected. It's fixed in .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3. Teams tracking Brotli-related CVEs can follow .NET security patch news on daily.dev."}},{"@type":"Question","name":"Does the Linux .NET tarball ownership vulnerability CVE-2026-114148 affect binary distributions or only source builds?","acceptedAnswer":{"@type":"Answer","text":"For .NET 10 and 11, CVE-2026-114148 only affects source-build tarballs. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who never build .NET from source. Fixed versions are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3, which replaces RC2. Developers patching Linux .NET deployments can keep up with tarball CVE fixes on daily.dev."}},{"@type":"Question","name":"Why did Microsoft re-release fixes for CVE-2026-70197 and CVE-2026-102870 after the October 13, 2026 .NET update?","acceptedAnswer":{"@type":"Answer","text":"The October 13, 2026 release did not fully address CVE-2026-70197, a SocketAsyncEventArgs memory corruption issue in .NET 8, 9, 10, and 11, and CVE-2026-102870, a Blazor WebAssembly debugger issue in .NET 10 and 11. Microsoft issued complete fixes for both in this out-of-band update, delivered in .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3. Anyone verifying a prior .NET patch actually closed a CVE can track follow-up fixes on daily.dev."}}]}
```