CVE-2026-111497, a critical flaw in Google's Brotli decompression library, was added to the CISA Known Exploited Vulnerabilities catalog on October 27, 2026. Brotli is a widely used web compression format, and the bug lets a specially crafted compressed stream write past the end of the decoder's buffer. The NVD entry lists possible outcomes from memory disclosure and denial of service to code execution.
If you run WordPress, a PHP application, a .NET service or anything else that fetches content from other servers, it is worth checking your exposure now. For most web hosts the realistic near-term risk is crashed workers and downtime, and the remedy is a routine library update plus a service restart.
What happened
The flaw sits in the decoder source file c/dec/decode.c and affects Google Brotli 1.0.3 through 1.2.0 on all platforms. Per the CVE record, a remote unauthenticated attacker could use a crafted stream to corrupt neighboring decoder memory, read sensitive memory, crash the process or potentially run code. The record gives a score of 9.2 (critical) and the weakness types CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write).
Google's v1.0.10 release flags the fix as a security change and was published on October 21. Fixed versions are 1.0.10, 1.1.1 and 1.2.1. CISA added the CVE to its catalog on October 27 and set a November 10 deadline for federal agencies, and it lists ransomware use as unknown. The research does not say who is exploiting the bug or at what scale.
Why a decompression bug reaches web servers
A decoder runs before your application ever inspects the data, so a flaw in it corrupts memory in whatever process is doing the unpacking. What makes this case unusual is the direction of travel. The hostile bytes often do not come in a request to your site. They come back in a reply from a server that your own software chose to contact.
Patchstack's write-up shows this for WordPress. WordPress ships no Brotli code of its own, but its outbound requests go through libcurl, which is set up to accept whatever compression it supports and unpack it. If the server's libcurl uses a vulnerable Brotli library, a reply labeled as Brotli is decoded inside libcurl before WordPress sees the body. Patchstack notes that the WordPress decompress=false option does not help, since it only affects a body libcurl has already unpacked.
Where the exposure is
WordPress and PHP
Patchstack describes several routes where WordPress fetches an address an attacker can influence, and therefore decodes a response the attacker controls:
- Pingbacks through xmlrpc.php: no account is needed, and a default install with a pingable published post qualifies.
- Plugins or themes that call WordPress HTTP functions on a user-supplied address.
- oEmbed discovery or the oEmbed proxy, which requires a Contributor-level account or higher.
- Feed fetching through SimplePie, which relies on a feed an administrator configured.
On impact, Patchstack separates what is easy from what is hard. Crashing a worker works on any build, and a lab published on October 27 shows a worker killed, or stuck at full CPU, by a payload of under a hundred bytes. Working code-execution shells are reported for stock Node.js and Bun binaries, but those depend on details of specific builds, and Patchstack says no public chain targets PHP behind Apache or FPM. It also warns that hard is not out of reach, because the per-build work only has to be done once. Plan for downtime first and treat code execution as harder, not ruled out.
The PHP project published rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) that include Brotli 1.2.1. It says the decoder is reachable on those Windows builds through the cURL extension when automatic response decompression is turned on. That setting is off by default in cURL, but applications and HTTP client libraries can enable it. The same announcement covers two other critical PHP flaws fixed in the same releases, which is another reason to update PHP.
.NET
Microsoft's advisory covers the Brotli decoder in .NET 8, 9, 10 and 11 and says .NET Framework is not affected. Microsoft rates it 8.1 (CVSS 3.1, high), lower than the 9.2 on the Brotli CVE record, so expect the two numbers to differ. ASP.NET Core request decompression and HttpClient automatic decompression are off by default, and merely having an affected package installed does not expose an app. Exposure needs one of these:
- ASP.NET Core request decompression with Brotli (br) enabled.
- HttpClient automatic decompression set to include Brotli or All.
- Direct use of BrotliStream or BrotliDecoder on untrusted data.
Microsoft lists 8.0.33 as the patched version for .NET 8 packages. Ubuntu's notice USN-8958-1 lists fixed packages for releases 22.04 LTS through 26.10, including 8.0.33 and 10.0.14 builds.
Other software
Any program that bundles or links Brotli may be affected. The CVE record references a Node.js security release. The Go package andybalholm/brotli tagged v1.2.7 on October 23, described as a port of a Google commit that detects invalid streams earlier. The research does not state whether that package is vulnerable, so check each vendor's own advisory.
How to check your exposure
- Identify the Brotli library your server provides. On Linux, look at the installed brotli packages and the libcurl your PHP uses, and compare against 1.0.10, 1.1.1 or 1.2.1. Distributions sometimes backport fixes without changing the upstream number, so read your vendor's notice.
- On Windows PHP, confirm you run one of the rebuilt packages with the -1 suffix.
- Test whether xmlrpc.php responds on your WordPress site. Many managed hosts and hardening plugins already block it.
- List plugins and themes that fetch remote URLs, such as link previews, importers and feed widgets. The plugin vulnerability list and our guide to checking whether a plugin is vulnerable can help.
- For .NET, search your code for AddRequestDecompression, AutomaticDecompression, BrotliStream and BrotliDecoder.
- Review logs for PHP workers that crash or restart repeatedly, CPU pinned at 100%, and bursts of POST requests to xmlrpc.php.
What to do now
- Install the operating system updates that carry the fixed Brotli library, then restart PHP-FPM, Apache and any other service that loaded the old one. Running processes keep the old library until restarted.
- Move PHP to a supported, patched release. The PHP project says 8.1 and older no longer get project updates, so use a vendor that backports fixes or upgrade.
- Update .NET to the patched runtime for your version, such as 8.0.33 for .NET 8, and redeploy.
- If you cannot patch yet, Microsoft advises not decompressing attacker-controlled Brotli data. Remove Brotli only from decompression settings you already use, and do not add decompression to an app that lacks it, because Microsoft warns that enabling it can introduce denial-of-service risk. Test before deploying.
- On WordPress, block xmlrpc.php if you do not need it, knowing that Patchstack says this closes only the easiest route.
- Limit the blast radius of a crash with sensible worker limits and automatic restarts, and keep a recent backup.
A WAF offers limited help here. Per Patchstack, the malicious data returns in a response your server requested rather than in the inbound request, so updating the library is the real fix.
Monitoring after the update
Because the visible sign of attempted abuse is likely to be instability, watch for it. Uptime monitoring can alert you when a site starts dropping out, and our uptime monitoring guide covers sensible alert settings. Check error logs for worker crashes for a few weeks, and re-verify library versions after each system update.
The research reports no confirmed compromises of WordPress sites through this bug and does not describe the exploitation CISA observed. If you find unexplained files or code on a server, follow our guide on what to do if your website is hacked.
Timeline
| Date | Event |
|---|---|
| October 21 | Google releases Brotli 1.0.10, 1.1.1 and 1.2.1 with the fix |
| October 22 | CVE record published |
| October 23 | andybalholm/brotli v1.2.7 tagged |
| October 25 | Microsoft .NET advisory issue opened |
| October 27 | CISA adds the CVE to KEV; a lab demonstrating the WordPress pingback crash is published |
| October 29 | Ubuntu publishes USN-8958-1 with patched .NET packages |
| October 30 | Patchstack publishes WordPress guidance |
| November 10 | CISA due date for federal agencies |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.
- Release v1.2.7: Detect and report invalid stream earlier · andybalholm/brotli (github.com)
- Microsoft Security Advisory CVE-2026-111497 | .NET Brotli Decoder Out-of-bounds Write Vulnerability · Issue #494 · dotnet/announcements (github.com)
- Release v1.0.10 · google/brotli (github.com)
- WordPress doesn (patchstack.com, )
- USN-8958-1: .NET vulnerabilities | Ubuntu security notices | Ubuntu (ubuntu.com, )
- Google Brotli Unchecked Return Value Vulnerability (CVE-2026-111497) is being actively exploited (nvd.nist.gov, )
- PHP (php.net, )
Tags: Brotli, CVE-2026-111497, CISA KEV, WordPress, PHP, libcurl