Brotli CVE-2026-111497 fixes for .NET, Python, PHP, and Ruby

As of November 5, 2026, 15:05 JST (06:05 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). This page covers CVE-2026-111497 outside Node.js. For Node.js itself, read Node.js October 2026 security release: what to update.

Updated November 5, 2026, 15:05 JST: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, so it is now being exploited. PECL now has the php-ext-brotli fix, Debian forky and Ubuntu 20.04 (through Ubuntu Pro) have fixed brotli packages, the tracker moved 7-Zip-zstd and NanaZip out of its unpatched list, Palo Alto has shipped PAN-OS hotfixes for firewalls that inspect Brotli traffic, and Node.js has announced another security release for November 11. The fixed versions are unchanged.

CVE-2026-111497, the out-of-bounds write in Google's Brotli decoder, is being exploited, per CISA, which listed it on October 27, 2026. It is fixed in .NET 8.0.33, 9.0.22, and 10.0.14, Python's Brotli 1.2.1 and brotlicffi 1.2.1.0, PHP's Windows builds 8.5.12-1 and its siblings, and the Ruby gem brotli 0.9.1.

Update each copy you run now, then restart or rebuild what loads it. The bug, which JPCERT/CC and Aikido also call HTTP2Shell, is in Brotli's C decoder, versions 1.0.3 to 1.2.0, so it reaches every program that bundles or links that code, not only Node.js: Palo Alto's PAN-OS firewalls too, when they inspect Brotli traffic. Google's CVE record scores it 9.2 (CVSS 4.0, Critical), and the NVD's own CVSS 3.1 score is 9.8 (Critical). CISA's Known Exploited Vulnerabilities catalog gives US federal agencies a due date of November 10, 2026, and CISA's entry in the CVE record now rates exploitation "active" (all checked November 5, 14:56 JST). An independent tracker, which names the bug Broccoli2Shell, still lists DuckDB, Apache Arrow's bundled build, v8-jsi, p7zip, EDK II, and woff2 as not fixed, as of its October 28 update.

Below: a table of fixed versions by ecosystem, what each one says about who is reachable, Linux distribution packages, the list still waiting for a fix, and how to find every copy of Brotli on a machine.

Fixed versions by ecosystem

Each row is from the project's own release, advisory, or package registry (checked October 27, 03:20 to 03:28 JST). Dates are UTC.

Node.js has announced its next security release, for 26.x, 24.x, and 22.x, “on or shortly after, Wednesday, November 11, 2026.” The announcement names no CVEs, and its highest severity is High (checked November 5, 14:58 JST). Until then, the Node.js versions in the table are the ones to run.

.NET

Microsoft's out-of-band release of October 25 calls the bug "A buffer overflow vulnerability exists in .NET's use of the Brotli decompression algorithm", on all platforms. Two of the three affected paths are off unless you turn them on: ASP.NET Core request decompression and HttpClient's AutomaticDecompression are "not enabled by default", per the post. The Brotli APIs in System.IO.Compression are affected when your code decompresses Brotli data through them. .NET Framework is not affected.

How you update depends on how you ship. A framework-dependent app needs the new runtime on the host and a restart. A self-contained app carries its own runtime, so installing a newer one on the host changes nothing: rebuild and republish. Rebuild container images from the updated .NET images. dotnet --list-runtimes shows what a host has, and self-contained apps and containers have to be checked one by one. The same release fixes CVE-2026-114148 in the Linux tarballs and re-releases the fixes for CVE-2026-70197 and CVE-2026-102870, which the October 13 release didn't fully address. For .NET built from GitHub source, the tracker says the public main branch moved to Brotli 1.1.1 on October 26, in pull request #136471 (checked November 5, 15:01 JST).

Python

Python itself doesn't decode Brotli; two PyPI packages do, and HTTP clients load them on their own. Aikido's analysis, updated October 26, says urllib3 and requests use Brotli or brotlicffi "when either is installed", aiohttp does when Brotli is installed, httpx does with its brotli extra, and Scrapy is affected too. Some packages install Brotli as a dependency, so you can have it without asking for it.

Aikido also warns that "Changing Accept-Encoding alone is insufficient": a malicious server can send a Brotli response whatever the client asked for, and urllib3 picks its decoder from the response's Content-Encoding header. The advisories are PYSEC-2026-4322 (Brotli) and PYSEC-2026-4323 (brotlicffi), and Aikido says pip-audit "should now" flag them. Upgrade with pip install --upgrade Brotli brotlicffi in each environment, then rebuild container images and any wheels that bundle either package. The CPython releases of October 25 list no Brotli fix; they are about other bugs (Python 3.15.2, 3.14.10 and older: eMudhra and tarfile fixes).

PHP

php.net's note of October 26 covers its Windows builds only: "In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it." The -1 suffix marks a rebuild with updated dependencies from the same PHP source, so php -v still shows 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The downloads page dates the new Windows packages October 26, 13:05 UTC (checked 03:26 JST).

The separate brotli extension, kjdev/php-ext-brotli, fixed the bug in 0.21.1 by updating its Brotli submodule to v1.2.1 (GitHub release, October 24, 23:49 UTC). PECL has listed 0.21.1 as stable since October 27, 05:12 JST (October 26, 20:12 UTC; checked November 5, 15:01 JST), so pecl install brotli now installs the fix.

This is a different bug from PHP's own October vulnerabilities: PHP October 2026 security release: what to update.

Ruby

The brotli gem moved to Brotli v1.2.1 in 0.9.1, published October 24 at 05:31 UTC. The same change makes the gem "Reject system Brotli without the CVE-2026-111497 fix", per the commit: "If the system library does not define it, use the vendored sources." So an unpatched system library is skipped and the gem builds its bundled 1.2.1 instead. 0.9.2 followed at 06:08 UTC with a memory-leak fix. Run bundle update brotli and restart the app.

Palo Alto PAN-OS

Palo Alto's advisory, published October 26 and updated October 31, says the bug is "applicable to PAN-OS software on PA-Series and VM-Series firewalls that have inspection of Brotli compressed traffic and TLS/SSL decryption enabled on the dataplane." PAN-OS 11.1 and 10.2 aren't affected, and neither is Panorama. "Brotli encoding is disabled by default in PAN-OS 11.2.4 and later," so a firewall is exposed only if show system setting brotli displays Enabled: yes.

The fixes are hotfixes: 12.2.4-h1 for 12.2; 12.1.4-h13, 12.1.7-h11, or 12.1.10-h3 for 12.1; and 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, or 11.2.16-h1 for 11.2. The advisory's timeline marks all of them released by October 29. One to skip: 11.2.10-h16 "only includes the fix for PHP vulnerabilities", and 11.2.10-h17 fixes both. Until you can upgrade, turn the inspection off with set system setting brotli-encoding disable, or untick Allow Brotli Encoding under Device > Setup > Content-ID on 12.1.2 and later. Prisma Cloud's Application Security Transporter Client is fixed in 0.2.9. The advisory says Palo Alto "is not aware of any malicious exploitation of this issue" (all checked November 5, 15:47 JST).

Linux distributions

On Debian, Node.js and brotlicffi use the system Brotli library, so the library package is the fix for both. Each cell is from the distribution's tracker or notice (checked November 5, 14:56 JST).

After the package update, restart every service that loaded the old library. A running process keeps the old code in memory.

Still unpatched, per the tracker

These are the tracker's words, last updated October 28 (checked November 5, 15:01 JST). The tracker says it is independent and "not affiliated" with Google, the Node.js project, or the Python Software Foundation.

NanaZip shipped its fix in 7.0.1882.0 on October 26, per the tracker, so it is off this list. The tracker's affected list also has Palo Alto PAN-OS, with hotfixes "rolling out 27–30 Oct" as of October 28; Palo Alto's own advisory now marks every hotfix released (PAN-OS).

Ports in other languages are a different case. The tracker says "Code execution is only possible in the C decoder": the Go port andybalholm/brotli "had the same logic error, but it would only have crashed, and it was fixed on 23 October", the Rust brotli-decompressor "catches the condition and returns an error", and "The Java, JavaScript and C# ports, which pdf.js, iText and HtmlUnit use, can't reach the bug."

Find and fix Brotli outside Node.js

1. List the Brotli copies on the machine

Check the system library with dpkg -l | grep -i brotli, rpm -qa | grep -i brotli, or apk info -v | grep -i brotli. To see which running processes have a Brotli decoder loaded, the tracker gives sudo grep -l brotlidec /proc/*/maps. A program that bundles its own copy, like the gem or the PyPI wheels, may not show up there, so check each language next.

2. Check each language's package

Python: pip show Brotli brotlicffi in every environment, and pipdeptree -r -p Brotli to see what pulled it in. Ruby: bundle list | grep brotli. PHP: php -m | grep -i brotli for the extension, and on Windows the build's -1 suffix on the download. .NET: dotnet --list-runtimes. Search lockfiles too: grep -i brotli poetry.lock uv.lock requirements*.txt Gemfile.lock composer.lock.

3. Update to the fixed version

Use the table above: the distribution's brotli package, pip install --upgrade Brotli brotlicffi, bundle update brotli, the new PHP Windows build or php-ext-brotli 0.21.1, the new .NET runtime or SDK, or the PAN-OS hotfix for your branch.

4. Rebuild what carries its own copy

Container images, self-contained .NET apps, wheels, and anything built against a bundled Brotli keep the old decoder until you rebuild them. Microsoft and Aikido both say this in their own words: "Rebuild and redeploy using updated .NET container images", and "Rebuild your container images and any wheels that bundle either package."

5. Restart, then check again

Restart every process that loaded the old decoder, then run the /proc/*/maps check and the language checks again.

Updates to this page

• November 5, 2026, 15:05 JST: CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-111497 since October 27, so the exploitation answer is now yes. The NVD's own score, 9.8. php-ext-brotli 0.21.1 on PECL, Debian forky's and Ubuntu 20.04's, 18.04's, and 16.04's fixed packages, the tracker's October 28 update, Palo Alto's PAN-OS hotfixes (read 15:47 JST), and the Node.js security release announced for November 11. The fixed versions are unchanged.
• October 27, 2026, 03:30 JST: first version. Sources read between 03:20 and 03:30 JST.

This page changes when a project in the unpatched table ships a fix, when Node.js ships its November 11 security release, and when CISA changes its catalog entry. The same week: Node.js October 2026 security release: what to update, PHP October 2026 security release: what to update, and Python 3.15.2, 3.14.10 and older: eMudhra and tarfile fixes. A self-hosted Next.js app reaches the Brotli decoder through Node.js, and Next.js fixed a separate Critical bug of its own on October 14: Next.js security releases in 2026: which version fixes what.

Frequently asked questions

Is .NET affected by CVE-2026-111497?

Yes. Microsoft's October 25 release fixes it in .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3. It affects ASP.NET Core request decompression and HttpClient automatic decompression, which are off by default, and the System.IO.Compression Brotli APIs. .NET Framework is not affected. Self-contained apps and containers must be rebuilt.

Do I need to update the Python Brotli package?

Yes, if pip show Brotli brotlicffi finds either one. Install Brotli 1.2.1 or brotlicffi 1.2.1.0. urllib3, requests, aiohttp, and httpx with its brotli extra decode Brotli responses through them, and removing br from Accept-Encoding doesn't stop a server from sending one.

Is PHP affected by the Brotli vulnerability?

php.net's Windows builds were, through the cURL extension when automatic response decompression is turned on; the fixed builds are 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 from October 26. The brotli extension is fixed in 0.21.1, on GitHub and, since October 27 (JST), on PECL (checked November 5, 15:01 JST).

Which Ruby brotli gem version fixes CVE-2026-111497?

0.9.1, published October 24, 2026, moves the gem to Brotli v1.2.1 and skips a system Brotli without the fix, building its bundled copy instead. 0.9.2, published the same day, adds a memory-leak fix.

Is CVE-2026-111497 being exploited?

Yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a due date of November 10 for US federal agencies, and CISA's assessment in the CVE record now says exploitation "active" (catalog version 2026.11.04, checked November 5, 14:56 JST). The tracker says that on October 26, ELLIO "reported that its sensors had recorded exploit traffic carrying the public PoC." JPCERT/CC's alert, last updated October 26, mentions no attacks (checked 15:01 JST). Update every copy of the decoder and restart what loads it now.

What is HTTP2Shell?

Another name for CVE-2026-111497. JPCERT/CC's alert says the bug is also called HTTP2Shell, and Aikido's article is titled "Node2Shell evolves to HTTP2Shell", because the bug reaches past Node.js into HTTP libraries and apps. An independent tracker at broccoli2shell.com calls it Broccoli2Shell. All of these names mean the same bug in Brotli's C decoder.

Are Go, Rust, and Java Brotli libraries affected?

Not by code execution, per the tracker: "Code execution is only possible in the C decoder." The Go port andybalholm/brotli could crash and was fixed on October 23, the Rust brotli-decompressor returns an error, and the Java, JavaScript, and C# ports "can't reach the bug." Java wrappers around the C library, such as Brotli4j, are a different case: the tracker lists Brotli4j as fixed.

Sources

Times are when this page read each source, in JST: October 27, 2026, and November 5, 2026, where given.

• .NET Blog: .NET October 2026 Out-of-Band Security Updates, October 25, 2026 (03:20)
• Broccoli2Shell tracker, last updated October 26, 2026 (03:21), and October 28, 2026 (November 5, 15:01)
• PHP: news archive 2026, "Updated PHP Windows builds for Brotli security fix", October 26, 2026, and the Windows downloads page (03:20, 03:26)
• kjdev/php-ext-brotli 0.21.1 (03:24) and PECL: brotli (03:24; November 5, 15:01)
• miyucy/brotli commits and RubyGems: brotli (03:24; RubyGems November 5, 15:01)
• Aikido: Node2Shell evolves to HTTP2Shell, updated October 26, 2026 (03:21)
• PyPI: Brotli and brotlicffi (03:21, 03:24; November 5, 15:01)
• JPCERT/CC: JPCERT-AT-2026-0034, October 26, 2026 (03:22; November 5, 15:01, in Japanese)
• Debian security tracker: CVE-2026-111497 (03:22; November 5, 14:56)
• Ubuntu: CVE-2026-111497 (03:22; November 5, 14:56, last updated October 29, 2026) and USN-8956-1 (03:22)
• CVE.org: CVE-2026-111497, updated October 26, 18:10 UTC (03:29), and November 4, 17:47 UTC (November 5, 14:56)
• NVD: CVE-2026-111497 (November 5, 14:56)
• Palo Alto Networks: CVE-2026-111497, published October 26, 2026, updated October 31 (November 5, 15:47)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.23 (03:28) and version 2026.11.04 (November 5, 14:56)
• Node.js: Wednesday, November 11, 2026 Security Releases, posted November 4, 2026, 08:00 JST (November 3, 23:00 UTC) (November 5, 14:58)