Brotli vulnerability affects curl and Git
bmitch3020
27 points
10 comments
October 23, 2026
Related Discussions
Found 5 related stories in 100.1ms across 10,409 title embeddings via pgvector HNSW
- Node.js Brotli RCE (CVE-2026-111497) nthypes · 16 pts · October 21, 2026 · 63% similar
- Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) khaled_ismaeel · 15 pts · October 22, 2026 · 61% similar
- Two ARM64-specific compiler optimization bugs, in GCC 15/16 and Rust, hit curl torutofu · 51 pts · October 06, 2026 · 53% similar
- Critical Vulnerabilities in PHP defly · 21 pts · October 20, 2026 · 52% similar
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) hayd · 113 pts · October 21, 2026 · 50% similar
Discussion Highlights (3 comments)
bmitch3020
CVE-2026-111497 is not limited to nodejs. The brotli decoder is also included in other projects, including curl[0] and git[1]. [0] https://infosec.exchange/@harrysintonen/117489564359709891 [1] https://infosec.exchange/@harrysintonen/117489801970908776
rasz
>decode.c What was that meme? "No Way to Prevent This, Says Only x Where This Regularly Happens" and from Google no less. Rare case of Mozilla W demanding JPEG XL decoder not be in C.
TacticalCoder
> A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) It sure sounds like lately it's not a great time to be a C lover with a deep hatred on Rust... And as a sidenote such exploits based on bugs in decoders is one of the main reason projects don't want to add support for every format under the sun (for example potential exploits has been invoked as a reason to not adopt jpeg-xl in a timely manner). But yeah: maybe, just maybe, that C afficionados could concede that a language making buffer overflows impossible is actually a good thing? Instead of resorting to logical fallacies which are basically: "There are exploits for any single language out there, hence every language is equally likely to have buffer overflows" .