Brotli Decoder Memory Flaw Affects Bun, Python and Envoy Decompression

· Cybersecurity

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, including Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer, a condition that can lead to remote code execution. Because Brotli is a widely used compression format for web content, the affected code is embedded in servers, runtimes and proxies rather than in a single product. Organizations need to identify which of their components decompress Brotli and apply updates, since an attacker only needs to send malicious compressed data to a reachable service.

Why it matters：A flaw in a common decompression library spreads exposure across runtimes and proxies, a reminder that shared codecs can widen a single CVE's blast radius.

Key points

  • The flaw is tracked as CVE-2026-111497.
  • Affected software includes Bun, Python Brotli packages and Envoy proxies.
  • Crafted compressed data can overwrite past a buffer and enable code execution.

Sources (original reporting)

More stories from this day