.NET emergency security updates fix Brotli and Linux tar ownership

Announced 2026-10-26 KST. Stable .NET 8.0.33, 9.0.22 and 10.0.14, plus prerelease 11 RC3, fix Brotli memory corruption (CVE-2026-111497) and Linux tar ownership (CVE-2026-114148). The latter affects source-build tarballs in 10/11 and also ASP.NET Core tarballs in 8/9. .NET Framework is unaffected. Update runtimes and restart framework-dependent apps; rebuild and republish self-contained apps, and rebuild and redeploy containers.

AI-edited

Sources

devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
dotnet.microsoft.com/download/dotnet/8.0
dotnet.microsoft.com/download/dotnet/9.0
dotnet.microsoft.com/download/dotnet/10.0
dotnet.microsoft.com/download/dotnet/11.0