Brotli CVE-2026-111497 fixes for .NET, Python, PHP, and Ruby

As of October 27, 2026, 03:30 JST (October 26, 18:30 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). This page covers CVE-2026-111497 outside Node.js. For Node.js itself, read Node.js October 2026 security release: what to update.

CVE-2026-111497, the out-of-bounds write in Google's Brotli decoder, is fixed in .NET 8.0.33, 9.0.22, and 10.0.14, the Python packages Brotli 1.2.1 and brotlicffi 1.2.1.0, PHP's Windows builds 8.5.12-1 and its siblings, and the Ruby gem brotli 0.9.1. Update each copy you run, then restart or rebuild what loads it.

The bug, which JPCERT/CC and Aikido also call HTTP2Shell, is in Brotli's C decoder, versions 1.0.3 to 1.2.0, so it reaches every program that bundles or links that code, not only Node.js. Google's CVE record scores it 9.2 (CVSS 4.0, Critical). CISA's Known Exploited Vulnerabilities catalog doesn't list it, and CISA's entry in the CVE record rates exploitation "none" (both checked 03:29 JST). An independent tracker, which names the bug Broccoli2Shell, still listed DuckDB, Apache Arrow's bundled build, 7-Zip-zstd, p7zip, EDK II, and woff2 as unpatched on October 26.

Below: a table of fixed versions by ecosystem, what each one says about who is reachable, Linux distribution packages, the list still waiting for a fix, and how to find every copy of Brotli on a machine.

Fixed versions by ecosystem

Each row is from the project's own release, advisory, or package registry (checked October 27, 03:20 to 03:28 JST). Dates are UTC.

.NET

Microsoft's out-of-band release of October 25 calls the bug "A buffer overflow vulnerability exists in .NET's use of the Brotli decompression algorithm", on all platforms. Two of the three affected paths are off unless you turn them on: ASP.NET Core request decompression and HttpClient's AutomaticDecompression are "not enabled by default", per the post. The Brotli APIs in System.IO.Compression are affected when your code decompresses Brotli data through them. .NET Framework is not affected.

How you update depends on how you ship. A framework-dependent app needs the new runtime on the host and a restart. A self-contained app carries its own runtime, so installing a newer one on the host changes nothing: rebuild and republish. Rebuild container images from the updated .NET images. dotnet --list-runtimes shows what a host has, and self-contained apps and containers have to be checked one by one. The same release fixes CVE-2026-114148 in the Linux tarballs and re-releases the fixes for CVE-2026-70197 and CVE-2026-102870, which the October 13 release didn't fully address. The tracker notes that .NET builds from GitHub source are still affected (checked 03:21 JST).

Python

Python itself doesn't decode Brotli; two PyPI packages do, and HTTP clients load them on their own. Aikido's analysis, updated October 26, says urllib3 and requests use Brotli or brotlicffi "when either is installed", aiohttp does when Brotli is installed, httpx does with its brotli extra, and Scrapy is affected too. Some packages install Brotli as a dependency, so you can have it without asking for it.

Aikido also warns that "Changing Accept-Encoding alone is insufficient": a malicious server can send a Brotli response whatever the client asked for, and urllib3 picks its decoder from the response's Content-Encoding header. The advisories are PYSEC-2026-4322 (Brotli) and PYSEC-2026-4323 (brotlicffi), and Aikido says pip-audit "should now" flag them. Upgrade with pip install --upgrade Brotli brotlicffi in each environment, then rebuild container images and any wheels that bundle either package. The CPython releases of October 25 list no Brotli fix; they are about other bugs (Python 3.15.2, 3.14.10 and older: eMudhra and tarfile fixes).

PHP

php.net's note of October 26 covers its Windows builds only: "In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it." The -1 suffix marks a rebuild with updated dependencies from the same PHP source, so php -v still shows 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The downloads page dates the new Windows packages October 26, 13:05 UTC (checked 03:26 JST).

The separate brotli extension, kjdev/php-ext-brotli, fixed the bug in 0.21.1 by updating its Brotli submodule to v1.2.1 (GitHub release, October 24, 23:49 UTC). PECL's release list still ends at 0.21.0 (checked 03:24 JST), so pecl install brotli doesn't get the fix yet; build 0.21.1 from the GitHub release or use your distribution's package.

This is a different bug from PHP's own October vulnerabilities: PHP October 2026 security release: what to update.

Ruby

The brotli gem moved to Brotli v1.2.1 in 0.9.1, published October 24 at 05:31 UTC. The same change makes the gem "Reject system Brotli without the CVE-2026-111497 fix", per the commit: "If the system library does not define it, use the vendored sources." So an unpatched system library is skipped and the gem builds its bundled 1.2.1 instead. 0.9.2 followed at 06:08 UTC with a memory-leak fix. Run bundle update brotli and restart the app.

Linux distributions

On Debian, Node.js and brotlicffi use the system Brotli library, so the library package is the fix for both. Each cell is from the distribution's tracker or notice (checked 03:22 JST).

After the package update, restart every service that loaded the old library. A running process keeps the old code in memory.

Still unpatched, per the tracker

These are the tracker's words, last updated October 26 (checked 03:21 JST). The tracker says it is independent and "not affiliated" with Google, the Node.js project, or the Python Software Foundation.

Ports in other languages are a different case. The tracker says "Code execution is only possible in the C decoder": the Go port andybalholm/brotli "had the same logic error, but it would only have crashed, and it was fixed on 23 October", the Rust brotli-decompressor "catches the condition and returns an error", and "The Java, JavaScript and C# ports, which pdf.js, iText and HtmlUnit use, can't reach the bug."

Find and fix Brotli outside Node.js

1. List the Brotli copies on the machine

Check the system library with dpkg -l | grep -i brotli, rpm -qa | grep -i brotli, or apk info -v | grep -i brotli. To see which running processes have a Brotli decoder loaded, the tracker gives sudo grep -l brotlidec /proc/*/maps. A program that bundles its own copy, like the gem or the PyPI wheels, may not show up there, so check each language next.

2. Check each language's package

Python: pip show Brotli brotlicffi in every environment, and pipdeptree -r -p Brotli to see what pulled it in. Ruby: bundle list | grep brotli. PHP: php -m | grep -i brotli for the extension, and on Windows the build's -1 suffix on the download. .NET: dotnet --list-runtimes. Search lockfiles too: grep -i brotli poetry.lock uv.lock requirements*.txt Gemfile.lock composer.lock.

3. Update to the fixed version

Use the table above: the distribution's brotli package, pip install --upgrade Brotli brotlicffi, bundle update brotli, the new PHP Windows build or php-ext-brotli 0.21.1, the new .NET runtime or SDK.

4. Rebuild what carries its own copy

Container images, self-contained .NET apps, wheels, and anything built against a bundled Brotli keep the old decoder until you rebuild them. Microsoft and Aikido both say this in their own words: "Rebuild and redeploy using updated .NET container images", and "Rebuild your container images and any wheels that bundle either package."

5. Restart, then check again

Restart every process that loaded the old decoder, then run the /proc/*/maps check and the language checks again.

Updates to this page

• October 27, 2026, 03:30 JST: first version. Sources read between 03:20 and 03:30 JST.

This page changes when PECL publishes the php-ext-brotli fix, when a project in the unpatched table ships one, when Debian fixes forky, when CISA adds the CVE to its catalog, and when anything about exploitation is reported. The same week: Node.js October 2026 security release: what to update, PHP October 2026 security release: what to update, and Python 3.15.2, 3.14.10 and older: eMudhra and tarfile fixes. A self-hosted Next.js app reaches the Brotli decoder through Node.js, and Next.js fixed a separate Critical bug of its own on October 14: Next.js security releases in 2026: which version fixes what.

Frequently asked questions

Is .NET affected by CVE-2026-111497?

Yes. Microsoft's October 25 release fixes it in .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3. It affects ASP.NET Core request decompression and HttpClient automatic decompression, which are off by default, and the System.IO.Compression Brotli APIs. .NET Framework is not affected. Self-contained apps and containers must be rebuilt.

Do I need to update the Python Brotli package?

Yes, if pip show Brotli brotlicffi finds either one. Install Brotli 1.2.1 or brotlicffi 1.2.1.0. urllib3, requests, aiohttp, and httpx with its brotli extra decode Brotli responses through them, and removing br from Accept-Encoding doesn't stop a server from sending one.

Is PHP affected by the Brotli vulnerability?

php.net's Windows builds were, through the cURL extension when automatic response decompression is turned on; the fixed builds are 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 from October 26. The brotli extension is fixed in 0.21.1, which is on GitHub but not yet on PECL (checked 03:24 JST).

Which Ruby brotli gem version fixes CVE-2026-111497?

0.9.1, published October 24, 2026, moves the gem to Brotli v1.2.1 and skips a system Brotli without the fix, building its bundled copy instead. 0.9.2, published the same day, adds a memory-leak fix.

Is CVE-2026-111497 being exploited?

No source read for this page reports exploitation. CISA's Known Exploited Vulnerabilities catalog, version 2026.10.23, doesn't list it, and CISA's assessment in the CVE record says exploitation "none" (checked 03:29 JST). JPCERT/CC's alert of October 26 mentions no attacks.

What is HTTP2Shell?

Another name for CVE-2026-111497. JPCERT/CC's alert says the bug is also called HTTP2Shell, and Aikido's article is titled "Node2Shell evolves to HTTP2Shell", because the bug reaches past Node.js into HTTP libraries and apps. An independent tracker at broccoli2shell.com calls it Broccoli2Shell. All of these names mean the same bug in Brotli's C decoder.

Are Go, Rust, and Java Brotli libraries affected?

Not by code execution, per the tracker: "Code execution is only possible in the C decoder." The Go port andybalholm/brotli could crash and was fixed on October 23, the Rust brotli-decompressor returns an error, and the Java, JavaScript, and C# ports "can't reach the bug." Java wrappers around the C library, such as Brotli4j, are a different case: the tracker lists Brotli4j as fixed.

Sources

Times are when this page read each source, in JST on October 27, 2026.

• .NET Blog: .NET October 2026 Out-of-Band Security Updates, October 25, 2026 (03:20)
• Broccoli2Shell tracker, last updated October 26, 2026 (03:21)
• PHP: news archive 2026, "Updated PHP Windows builds for Brotli security fix", October 26, 2026, and the Windows downloads page (03:20, 03:26)
• kjdev/php-ext-brotli 0.21.1 and PECL: brotli (03:24)
• miyucy/brotli commits and RubyGems: brotli (03:24)
• Aikido: Node2Shell evolves to HTTP2Shell, updated October 26, 2026 (03:21)
• PyPI: Brotli and brotlicffi (03:21, 03:24)
• JPCERT/CC: JPCERT-AT-2026-0034, October 26, 2026 (03:22, in Japanese)
• Debian security tracker: CVE-2026-111497 (03:22)
• Ubuntu: CVE-2026-111497 and USN-8956-1 (03:22)
• CVE.org: CVE-2026-111497, updated October 26, 18:10 UTC (03:29)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.23 (03:28)