Brotli CVE-2026-111497 and git-remote-https

Summary by Cyber Security News26 Oct 2026, 17:40 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/393

Posted by Harry Sintonen on Oct 26 I haven't seen this mentioned here, yet: git https remote (git-remote-https) is vulnerable to CVE-2026-111497, too, when libcurl has been built with brotli support (generally this is the case for most distros). When scanning for vulnerable apps using libcurl also check for CURLOPT_ENCODING since this is an alias for CURLOPT_ACCEPT_ENCODING. Fair bit of older code still uses this old option name.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.