The critical vulnerability CVE-2026-111497 in Google’s Brotli decoder continues to trigger a wave of emergency updates. After the initial patches for Node.js, Bun and Python packages, which we have already covered, on October 26 PHP rebuilt its official Windows packages, and Microsoft released fixes for .NET, Visual Studio and PowerShell. The vulnerability makes it possible to corrupt memory and potentially execute arbitrary code via specially crafted Brotli data. On October 27 CISA added the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2026.
Essence of the vulnerability and severity ratings
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder affecting library versions from 1.0.3 to 1.0.9, 1.1.0 to 1.1.0, and version 1.2.0. Exploitation can lead to a process crash, leakage of memory contents or remote execution of arbitrary code.
Severity ratings differ depending on the methodology. According to the GitHub Advisory Database, the vulnerability scored 9.2 on the CVSS 4.0 scale (Critical). Red Hat rates it at 8.1 on CVSS 3.1 (Important), pointing to high attack complexity — reliable exploitation is hampered by hardware and software protection mechanisms. These ratings use different CVSS versions and different assumptions, so comparing them directly is incorrect.
The vulnerability was discovered by researchers whom JFrog and Wiz identify as Khai Tran and Sylvie Mayer from OpenAI Codex Security, although no direct confirmation from OpenAI has been found in publicly available sources. Google fixed the issue in Brotli versions 1.2.1, 1.1.1 and 1.0.10.
Affected products and exploitation conditions
The key takeaway from analyzing both updates: the vulnerability is configuration-dependent rather than universal. Each affected product has its own conditions under which malicious Brotli data reaches the vulnerable decoder.
PHP on Windows
According to the PHP announcement, the vulnerable decoder is exposed via the cURL extension when automatic decompression of HTTP responses is enabled. cURL itself does not enable this feature by default — applications or HTTP clients activate it via the CURLOPT_ENCODING option.
However, the Guzzle library versions 7.16.1 and 8.3.1, according to an analysis of its source code, set CURLOPT_ENCODING to an empty string by default when using the cURL handler. An empty value enables all supported decompression formats, including Brotli. This means that applications using Guzzle with default settings on previous Windows builds of PHP met the conditions for the vulnerability to trigger. The attack arrives as a specially crafted compressed response from the server that the PHP application is calling.
PHP has released rebuilt packages:
8.5.12-18.4.27-18.3.36-18.2.35-1
These builds contain the same PHP source code as the October 21 releases (including the PHP2Shell fixes), but now include Brotli 1.2.1. Since the PHP version has not changed, the php -v command will show the same number. You can distinguish the new build by the -1 suffix in the file name and by the SHA-256 hash on the downloads page.
Microsoft .NET
According to the Microsoft advisory, fixes were included in .NET versions 8.0.33, 9.0.22, 10.0.14 and .NET 11 Release Candidate 3. Visual Studio 2019, 2022 and 2026, as well as PowerShell 7.4, 7.5 and 7.6, also received updates.
In .NET, exploitation conditions differ from PHP: ASP.NET Core and HttpClient do not perform automatic Brotli decompression by default. A threat arises only if an application explicitly enables decompression of requests or responses, or directly uses the Brotli API to process data from untrusted sources.
Scope of the problem beyond PHP and .NET
Brotli is embedded in many projects, and updating the system library is not enough if an application ships with its own copy of the decoder. According to JFrog’s research, the vulnerable decoder can be reached not only via HTTP clients, but also through file parsers, media tools and other native integrations. In particular, JFrog demonstrated an exploitation chain via FFmpeg and a specially crafted JPEG XL image, where the libjxl library uses Brotli to unpack metadata.
According to Wiz, components vulnerable to CVE-2026-111497 are present in 91% of cloud environments, and 82% of such environments contain publicly accessible Node.js instances. These figures have not been independently confirmed by other sources, but they reflect the widespread use of Brotli in containerized applications, Kubernetes clusters, API gateways and reverse proxies.
Exploitation status
There have been no confirmed cases of CVE-2026-111497 being exploited in real-world attacks so far. However, Imperva researchers have demonstrated a working PoC exploit with remote code execution on an official Node.js build. Adding the vulnerability to the CISA KEV catalog on October 27 with a remediation deadline of November 10 indicates that the regulator considers the threat serious enough to require mandatory action.
Recommendations
For PHP on Windows: install the rebuilt packages with the -1 suffix from the PHP downloads page. If an immediate update is not possible, a temporary measure is to disable automatic Brotli decompression. In PHP code this means not setting CURLOPT_ENCODING. In Guzzle — set the request option decode_content to false (this will disable decompression of all formats, including gzip). Important: simply removing br from the Accept-Encoding header is not enough — the server can still send a Brotli response.
For .NET: update to versions 8.0.33, 9.0.22, 10.0.14 or .NET 11 RC3, respectively. Check whether the application uses explicit Brotli decompression or direct calls to the Brotli API.
For all platforms: inventory should identify not only the top-level package version, but also any embedded or statically linked copies of Brotli, as well as the paths by which untrusted data reaches the decoder. Projects that ship their own copy of the library require a separate update from the developers.
Given that CVE-2026-111497 has been added to CISA KEV with a November 10 deadline and there are public PoC exploits, updating affected components should be treated as a priority task. Organizations using PHP on Windows with Guzzle or other HTTP clients with automatic decompression are advised to update first — in this configuration the exploitation conditions are met by default.
