53 points | by cowlevel 2 hours ago ago
11 comments
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
This is a better article: https://www.aikido.dev/blog/python-packages-vulnerable-node2...
and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...
OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release - until their agent realised it was.
https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
Likely mitigation: disable brotli (br) content-encoding on both sides
https://x.com/AikidoSecurity/status/2113759110625906950
is flask hello world with gunicorn behind apache vulnerable?
what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected
whether a hello wolrd in fastapi is affected might also be interesting
Another day, another buffer-overflow vulnerability in C code …
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
This is a better article: https://www.aikido.dev/blog/python-packages-vulnerable-node2...
and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...
OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release - until their agent realised it was.
https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
Likely mitigation: disable brotli (br) content-encoding on both sides
https://x.com/AikidoSecurity/status/2113759110625906950
is flask hello world with gunicorn behind apache vulnerable?
what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected
whether a hello wolrd in fastapi is affected might also be interesting
Another day, another buffer-overflow vulnerability in C code …