Across the software world, a single small piece of compression code, Google's Brotli decoder, has turned out to live inside far more products than anyone tallied at first. Microsoft and the PHP project have now shipped their repairs, following Node.js by about a week, and the episode shows how a flaw in a shared component becomes a long, uneven chore of rebuilding and redeploying. How dangerous the flaw truly is remains a matter of honest disagreement among those who study it, and that uncertainty is itself part of the story.
Microsoft, PHP and Linux Ship Fixes for Google Brotli Flaw as Exploitability Remains Disputed
Many products carry their own copy of the decoder, so each needs its own update.
Mark
Why did Microsoft and PHP only patch now, when Node.js fixed this last week?
Mimi
The reporting says it followed an industry realisation of how widespread the flaw is. Brotli is bundled into many products, so each vendor has to ship its own update.
Mark
So there's no single fix?
Mimi
Right. Google fixed it in 1.0.10, 1.1.1 and 1.2.1, but every product carrying its own copy needs its own release.
Luke
Microsoft calls it 8.1 out of 10. Does that mean attackers are exploiting it?
Mimi
Not according to what's reported. Microsoft rates exploitation as more likely, but Red Hat says public proof-of-concept code only causes crashes.
Luke
So the severity score and the observed reality differ. And we don't know who's right yet. The source says no reliable remote code execution exploit has been seen, which is not the same as saying none can exist.
Mark
What about the JFrog finding?
Mimi
They showed an attack through FFmpeg using a crafted image file. It means the risk isn't limited to web traffic.
Luke
Worth noting that's a demonstration by researchers, and the piece doesn't say whether it achieves code execution.
Mark
What should administrators do right now?
Mimi
Patch where fixes exist, rebuild self-contained and NativeAOT .NET apps, and on Red Hat systems reject Brotli traffic from untrusted clients at proxies until packages arrive.
Luke
And macOS is simply unknown. Apple hasn't said.
The Pulse
- A out-of-bounds write flaw, CVE-2026-111497, reaches across Brotli versions 1.0.3 through 1.2.0 and forces every bundling product to patch on its own schedule.
- Microsoft rates the flaw 8.1 out of 10 and pushes out-of-band .NET fixes for versions 8, 9 and 10, urging customers to update as soon as possible.
- Researchers disagree on exploitability: Red Hat has seen only crash-causing proof-of-concept code, while JFrog has shown an attack reaching through FFmpeg using a crafted image.
- Self-contained and NativeAOT .NET applications must be rebuilt and redeployed, and Red Hat Enterprise Linux 7 through 10 still waits without fixed packages.
- Administrators are advised to reject Brotli-encoded traffic from untrusted clients at proxies and load balancers until every patch reaches their systems.
Across the software world, a single small piece of compression code, Google's Brotli decoder, has turned out to live inside far more products than anyone tallied at first. Microsoft and the PHP project have now shipped their repairs, following Node.js by about a week, and the episode shows how a flaw in a shared component becomes a long, uneven chore of rebuilding and redeploying. How dangerous the flaw truly is remains a matter of honest disagreement among those who study it, and that uncertainty is itself part of the story.
Microsoft and the PHP project have now shipped fixes for a flaw in Google's Brotli decoder, roughly a week after Node.js patched the same bug. The pattern is becoming familiar: many products quietly carry their own copy of this compression code, so there is no single upstream fix that protects everyone at once.
The flaw, tracked as CVE-2026-111497, is an out-of-bounds write affecting Brotli 1.0.3 through 1.2.0. Google fixed it in 1.0.10, 1.1.1 and 1.2.1, but each product must update its own bundled copy.
The danger is still contested. Attack complexity is rated high because exploitation requires a precisely crafted data stream. Red Hat reports that public proof-of-concept code only crashes, while JFrog has demonstrated an attack through the FFmpeg media framework using a crafted image file, taking the risk beyond web traffic.
Microsoft rates the flaw 8.1 out of 10 and has released out-of-band updates for .NET 8, 9 and 10, with fixed runtimes 8.0.33, 9.0.22 and 10.0.14. Its exposure is narrower than Node.js, since ASP.NET Core and HttpClient do not decompress Brotli by default, but self-contained and NativeAOT applications must be rebuilt and redeployed.
PHP has released rebuilt Windows packages, and on Linux the fix depends on each distribution. Debian, Alpine, Ubuntu and openSUSE Tumbleweed have shipped fixes. Red Hat Enterprise Linux 7 through 10 remains unpatched, so administrators are advised to reject Brotli traffic from untrusted clients meanwhile. Apple has not yet said whether macOS is affected.
Microsoft and the PHP project have now shipped fixes for a flaw in Google's Brotli decoder, a week after Node.js patched the same bug. The sequence reflects a growing realisation across the industry of how many products quietly carry this one piece of compression code.
The flaw is tracked as CVE-2026-111497. It is an out-of-bounds write affecting Brotli versions 1.0.3 through 1.2.0. Google has fixed it in versions 1.0.10, 1.1.1 and 1.2.1. The complication is that many products bundle their own copy of the decoder, so each one needs its own update rather than a single upstream fix.
How dangerous the bug is in practice is still contested. Attack complexity is rated high, because exploitation requires a precisely crafted data stream. Microsoft rates exploitation as more likely. Red Hat says the public proof-of-concept code causes crashes, but that no reliable remote code execution exploit has been seen. Researchers at JFrog, meanwhile, have demonstrated an attack through the FFmpeg media framework using a crafted image file, which carries the flaw beyond web traffic.
Microsoft scores the vulnerability 8.1 out of 10 in .NET and has released out-of-band updates for .NET 8, 9 and 10, plus the 11 release candidate. The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14. PowerShell and Visual Studio have been patched too. Rahul Bhandari, a senior program manager at Microsoft, said: "We recommend updating as soon as possible."
Exposure in .NET is narrower than in Node.js, since ASP.NET Core and HttpClient do not decompress Brotli data by default. There is one catch for developers: self-contained and NativeAOT applications carry their own copy of the runtime. Those must be rebuilt and redeployed, not simply updated on the server.
PHP has released rebuilt Windows packages that bundle the fixed Brotli library: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. On Windows, attackers can reach the decoder through the cURL extension, but only when automatic response decompression is switched on, which is not the default. On Linux, PHP relies on each distribution's own Brotli library, so the fix depends on the distributions.
That patching is underway. At the time of writing, Debian, Alpine, Ubuntu and openSUSE Tumbleweed had shipped fixed packages. Red Hat lists Enterprise Linux 7 through 10 as affected and has no fixed packages yet. Until it does, it advises administrators to strip or reject Brotli-encoded traffic from untrusted clients at reverse proxies and load balancers. Apple has not said whether macOS is affected.
The open items are clear: Red Hat's packages, Apple's answer, and the rebuilds that self-contained .NET applications now require.
Notable Quotes
We recommend updating as soon as possible.— Rahul Bhandari, senior program manager, Microsoft
Want the full story?
Read the original at iTnews ↗