Brotli decoder flaw fixes land for .NET, PHP and Linux as the scale of exposure becomes clear

Microsoft and the PHP project have released fixes for a flaw in Google's Brotli decoder, which Node.js patched last week. The bug, CVE-2026-111497, is an out-of-bounds write in Brotli versions 1.0.3 to 1.2.0, and Google has fixed it in versions 1.0.10, 1.1.1 and 1.2.1. Many products carry their own copy of the decoder, so each needs its own update. Researchers at JFrog have also shown an attack through the FFmpeg media framework using a crafted image file, which takes the flaw beyond web traffic.

The danger is disputed. Attack complexity is rated high and needs a precisely crafted data stream. Microsoft rates exploitation as more likely, while Red Hat says public proof-of-concept code causes crashes but no reliable remote code execution exploit has been seen. Microsoft scores the flaw 8.1 out of 10 in .NET and has issued out-of-band updates: runtimes 8.0.33, 9.0.22 and 10.0.14, plus fixes for PowerShell and Visual Studio. Exposure is narrower than in Node.js, as ASP.NET Core and HttpClient do not decompress Brotli data by default. Self-contained and NativeAOT applications must be rebuilt and redeployed.

PHP has released rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1). On Windows, attackers can reach the decoder through the cURL extension only if automatic response decompression is turned on, which is not the default. Debian, Alpine, Ubuntu and openSUSE Tumbleweed have shipped fixes. Red Hat lists Enterprise Linux 7 to 10 as affected with no fixed packages yet, and advises blocking Brotli-encoded traffic from untrusted clients at reverse proxies and load balancers. Apple has not said whether macOS is affected.