The Brotli RCE is an HTTP problem, not a TLS one
A memory-corruption bug in Google's Brotli decoder, CVE-2026-111497, got the scary framing it deserves — The Hacker News leads with the Node.js RCE and the long tail of affected software, and the oss-security list carried the coordination thread. Before you start grepping your mail stack in a panic, though, let me narrow the blast radius, because the triage instinct ("Brotli is in TLS, so my mail TLS is exposed") is wrong.
Where Brotli actually lives
Brotli is an HTTP content-encoding. It is the thing that shrinks a web response marked Content-Encoding: br. TLS-level compression is dead and has been since CRIME; your Postfix SMTP and Dovecot IMAP sessions do not negotiate Brotli. So the STARTTLS path your mail actually travels on is not where this bites.
What does matter is everything web-shaped that sits around a mail server. The webmail and admin surfaces — Zimbra's UI, Roundcube or SOGo on an iRedMail box, anything behind nginx or an Envoy sidecar — only decode Brotli if they are configured to. The source is explicit that Envoy and Istio are reachable only when the Brotli decompressor is turned on. If you never enabled it, the flaw cannot be reached there. That is the honest "you can ignore this" case for a lot of readers.
The part that catches people: outbound and Python
The bug cuts both ways. A server that unpacks attacker-controlled Brotli can be taken over by a malicious client — but so can a client that unpacks a Brotli response from a malicious server. Per OpenAI's write-up quoted by The Hacker News, even something like curl --compressed fetching from a hostile endpoint is in scope. For mail admins that means outbound HTTP: webhook callbacks, API lookups, abuse-feed pulls, any little script that reaches out and trusts the far end.
Python is the sneaky one. The risk is simply having the Brotli or brotlicffi package installed. Once it is present, requests, urllib3, httpx, and aiohttp will decode br responses on their own — your code never has to import anything. Plenty of mail-adjacent glue (milters, reputation scripts, provisioning tooling) runs on exactly those clients. Worse, as the write-up notes, Dependabot may not flag this yet because the CVE names Google's repository rather than the PyPI packages, so check the installed versions by hand. The fixed Python releases are Brotli 1.2.1 and brotlicffi 1.2.1.0.
One workaround that does not work: dropping br from your Accept-Encoding header. A server can return Brotli regardless of what the client asked for, so that buys you nothing. The real fix is to stop decoding untrusted Brotli or to update the decoder.
What to do Monday
Because every program ships its own copy of Google's C decoder, there is no single patch — each has to update its own vendored copy. Confirm versions before you touch anything; I'm not going to hand you an invented command. From the table The Hacker News published, the fixed lines are Brotli 1.0.10 / 1.1.1 / 1.2.1, Node.js 22.23.4 / 24.22.1 / 26.12.1, and Bun 1.4.4. Distro packages lag unevenly: Debian 13 (trixie) got brotli 1.1.0-2+deb13u1 on 23 October, while Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending as of 22 October.
After you update, restart the service and rebuild any container image. A long-running process keeps the old decoder resident until it restarts — a patched package on disk means nothing to a daemon that has been up for forty days.
No in-the-wild exploitation has been reported, CISA scored exploitation as none, and Imperva's working Node.js exploit took several tries on one specific ARM64 Linux build and has not been released. This is a patch-at-the-next-window problem for most of us, not a drop-everything one — but the Python and outbound-fetch angles are the ones I'd actually go check tonight.
Sources
Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
More about the author →Was this article helpful?
Tap a star — no sign-in needed.
Be the first to rate this article.
Related guides
Barracuda's Chained Root Bug: It's About Where Your Admin Interface Lives
Barracuda has published details of two vulnerabilities that, chained together, hand an attacker root on the appliance. The Hacker News has the full breakdown; BleepingComputer corroborates the disclosure. If you run a Barracuda Email Security Gateway in front of your mail flow — and plenty of shops still do, sitting it ahead of Postfix or a Zimbra edge — this is worth ten minutes of your attention today. But read past the CVSS scores before you panic, because the two numbers tell you more about how you're exposed than whether you're doomed.
Two Linux Bugs, One Scary Number, and Which One Is Actually Rooting Servers
This week produced two separate Linux kernel stories that are very easy to mash into one, and the triage note that landed on my desk did exactly that. They are not the same bug, they do not carry the same urgency, and treating them as one leads you to patch the wrong thing first. Let me pull them apart.
Two PHP Engine Bugs Hit the KEV List — Your Webmail Is the Exposed Part
On 26 October, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog and refreshed its earlier PHP alert ("Critical Vulnerabilities in PHP Require Immediate Patching," from 21 October):
A Gitea Code-Injection Bug Is Being Exploited — Patch, Then Assume the Worst
CISA added CVE-2026-60004 , described as a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog on 25 August 2026. The KEV listing is the important part: CISA doesn't add things to that catalog on theory. It adds them when there's evidence of active exploitation in the wild. So this isn't "a bug was disclosed" — it's "somebody is using this against real servers right now."