Vulnerability in Brotli Library Could Allow for Remote Code Execution

This message is intended for U-M IT staff who are responsible for university servers and applications that process Brotli-compressed data.

Summary

A critical vulnerability in the Brotli compression library, CVE-2026-111497, could allow an unauthenticated remote attacker to corrupt memory, disclose sensitive information, crash affected processes, or potentially execute code. Identify affected systems and apply vendor updates as soon as possible after appropriate testing.

The need for immediate action supersedes the remediation timeframes in Vulnerability Management (DS-21).

Problem

The vulnerability is an out-of-bounds write in the Brotli decoder. Exposure occurs when attacker-controlled Brotli-compressed data reaches a vulnerable decoder, including through compressed HTTP request bodies, responses retrieved from untrusted servers, or compressed files. Applications that bundle their own vulnerable Brotli copy may remain exposed even if the system Brotli library is updated. Public proof-of-concept code is available, although no known malicious exploitation is reported in the wild.

Affected Systems

Affected software identified by the supplied sources includes:

  • Google Brotli 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.
  • Node.js versions before 22.23.4 (22.x), 24.22.1 (24.x), and 26.12.1 (26.x). 
    • Node.js 20.x, 23.x, and 25.x are end-of-life and will not receive fixes.
  • Bun 1.4.3 and earlier.
  • Envoy Proxy before 1.37.8, 1.38.6, 1.39.3, and 1.40.0, and Istio before 1.29.9, 1.30.6, and 1.31.2, when the Brotli decompressor is configured.
  • Python Brotli 1.2.0 and earlier, brotlicffi 1.2.0.x and earlier
  • Java brotli4j before 1.24.0.
  • Microsoft .NET 8, 9, and 10 installations not updated to the out-of-band fixed releases when applications opt in to Brotli decompression; .NET 11 prerelease builds before Release Candidate 3.
  • Official PHP Windows packages for PHP 8.2 through 8.5 built before the rebuilt fixed packages.

Other products that embed vulnerable Brotli versions may also be affected. Review vendor advisories and software bills of materials.

Detection

Inventory deployed versions and inspect application dependencies, container images, package lock files, vendor advisories, and software bills of materials for vulnerable Brotli components. Determine whether applications accept or retrieve untrusted Brotli-compressed content and whether automatic Brotli decompression is enabled. Ensure the Tenable agent is installed on all servers to facilitate detection of vulnerabilities for which there are plugins. 

Action Items

  • Identify web servers, applications, runtimes, libraries, containers, and appliances that process Brotli-compressed data, including products that bundle Brotli.
  • Apply vendor-provided security updates as soon as possible after appropriate testing. Prioritize internet-facing systems and applications that decode data from untrusted sources.
  • For .NET, update supported installations to .NET 8.0.33, 9.0.22, 10.0.14, or .NET 11 Release Candidate 3 as applicable.
  • For official PHP Windows packages, install the rebuilt 8.2.35-1, 8.3.36-1, 8.4.27-1, or 8.5.12-1 package as applicable and verify the build filename and vendor-provided SHA-256 hash.
  • Upgrade end-of-life software to a supported release.
  • If updates cannot be applied immediately, follow vendor guidance to disable Brotli decoding or block incoming Brotli-compressed requests until remediation is complete. Test any workaround because disabling decompression can affect application behavior.

Technical Details

CVE-2026-111497 is an out-of-bounds write in Brotli decompression. Google rates the flaw 9.2 out of 10, or Critical, on the CVSS 4.0 scale. Red Hat rates it 8.1, or Important, on the CVSS 3.1 scale.

Exploitability depends on attacker-controlled Brotli data reaching a vulnerable decoder. Brotli decompression is not enabled by default in a standard .NET or ASP.NET Core installation, but applications can opt in through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs. PHP Windows applications may be exposed when cURL or an HTTP client such as Guzzle automatically decompresses Brotli responses.

How We Protect U-M

ITS provides CrowdStrike Falcon to units, which should be installed on all U-M owned systems (Windows, macOS, and Linux operating systems, whether workstations or servers). Falcon administrators in ITS and in U-M units use the Falcon console to investigate and remediate issues.

Questions, Concerns, Reports

Please contact ITS Information Assurance through the ITS Service Center.