.NET October 2026 Out-of-Band Security Updates
Comments on “.NET October 2026 Out-of-Band Security Updates”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Microsoft released out-of-band security updates for .NET 8 (8.0.33), .NET 9 (9.0.22) and .NET 10 (10.0.14), plus .NET 11 RC3. They fix a Brotli decompression buffer overflow (CVE-2026-111497) that could expose or corrupt memory, and unsafe ownership metadata in Linux tarballs (CVE-2026-114148). Two earlier fixes from the October 13 release were incomplete and are re-issued. Self-contained apps and containers must be rebuilt. Microsoft's own advisory is the only source here, and the claims were not independently verified.
Why it ranked
No. 4 of 62 with a score of 0.73. The panel rated it highest on practical relevance (0.93) and new information (0.91), lowest on technical depth (0.62).
Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.2
- Significance0.66
- Reader interest0.73
- Audience breadth0.62
- Practical relevance0.93
- Substantiated0.84
- Technical depth0.62
- New information0.91
- Counts against: Promotional0.05
- Counts against: Overclaim0.09
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.67 | 0.60 | 0.72 | 0.66 | 0.12 | +0.24 | +0.159 |
| Reader interest | 0.58 | 0.80 | 0.82 | 0.73 | 0.24 | +0.26 | +0.191 |
| Audience breadth | 0.62 | 0.70 | 0.55 | 0.62 | 0.15 | +0.13 | +0.081 |
| Practical relevance | 0.97 | 0.90 | 0.90 | 0.93 | 0.07 | +0.22 | +0.204 |
| Substantiated | 0.83 | 0.80 | 0.90 | 0.84 | 0.10 | +0.05 | +0.042 |
| Technical depth | 0.74 | 0.50 | 0.62 | 0.62 | 0.24 | +0.05 | +0.031 |
| New information | 0.95 | 0.80 | 0.98 | 0.91 | 0.18 | +0.05 | +0.046 |
| Promotional | 0.06 | 0.05 | 0.04 | 0.05 | 0.02 | −0.19 | −0.010 |
| Overclaim | 0.10 | 0.10 | 0.08 | 0.09 | 0.02 | −0.11 | −0.010 |
| Sum of contributions | +0.733 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.733 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-26/4/"><img src="https://rubric.hrih.si/badge/2026-10-26/4.svg" alt="Ranked #4 on Rubric, 26 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
CVE-2026-111497 is a buffer overflow vulnerability in .NET's use of the Brotli decompression algorithm that may allow an unauthenticated attacker to read or corrupt process memory, affecting all platforms.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
Couldn’t checkNumber
CVE-2026-114148 involves unsafe ownership metadata in affected .NET tarballs that could allow a local attacker to modify files and gain elevated privileges on Linux.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148
No source givenVersion
The out-of-band release includes .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3.
The article gives no link or citation for it.
The article says “we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3”
The source says No source to compare with.
Couldn’t checkCausal conclusion
The October 13, 2026 release did not fully address CVE-2026-70197 and CVE-2026-102870, so their advisories are being re-released with fixes in today's updates.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October…”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197
No source givenGeneralization
Applications may be affected by the Brotli vulnerability if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.
The article gives no link or citation for it.
The article says “Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs”
The source says No source to compare with.
No source givenGeneralization
Request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected.
The article gives no link or citation for it.
The article says “Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected”
The source says No source to compare with.
Couldn’t checkGeneralization
For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only, while for .NET 8 and .NET 9 it also affects ASP.NET Core tarball distributions.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 5 pts, not on front page
Recorded for context only, checked 26 Oct 2026, 07:27 UTC. It played no part in the ranking.