Google Brotli decompression flaw, used by many web tools, added to CISA's exploited list (CVE-2026-111497)

29 October 2026HighBeing exploited

Google · Brotli compression library · CVE-2026-111497

Google Brotli decompression flaw, used by many web tools, added to CISA's exploited list

Brotli is a compression library built into many browsers, web servers and HTTP clients. An unchecked return value in its decoder lets a crafted compressed stream corrupt memory, leak data, crash the program or potentially run code, with no login. Brotli fixed it in version 1.2.1 on 21 October and CISA added it to its Known Exploited Vulnerabilities list on 27 October. No CVSS score was available from a source we opened.

Affected: Software that bundles Brotli before 1.2.1 and decompresses data from untrusted sources. PHP's Windows builds were affected through the cURL extension when automatic response decompression is switched on, which is off by default.
What to do: Update to Brotli 1.2.1 or to product releases that include it. For PHP on Windows, install the rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1. Keep browsers, web servers and libraries that bundle Brotli up to date, and ask your suppliers if unsure.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Confirmed exploited (CISA KEV) in a compression library embedded in a great deal of web software.

Google Brotli decompression flaw, used by many web tools, added to CISA's exploited list

Affected

Software that bundles Brotli before 1.2.1 and decompresses data from untrusted sources. PHP's Windows builds were affected through the cURL extension when automatic response decompression is switched on, which is off by default.

What to do

Update to Brotli 1.2.1 or to product releases that include it. For PHP on Windows, install the rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1. Keep browsers, web servers and libraries that bundle Brotli up to date, and ask your suppliers if unsure.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Confirmed exploited (CISA KEV) in a compression library embedded in a great deal of web software.