A Python client can start decoding Brotli responses because a package is installed, even when the application’s own code never imports it. For the administrator checking that service, searching the source code for Brotli calls can miss the route entirely. The dependency changes the client’s behaviour. [2]
The Hacker News reports that installing either Python’s Brotli or brotlicffi package enables HTTP clients including requests and httpx to decode those compressed responses automatically. A remote server supplies the bytes. The local process unpacks them. [2]
CVE-2026-111497 lets crafted Brotli data overwrite a buffer and corrupt memory. Researchers demonstrated attacker-controlled code execution on one unpatched Node.js build, through both a fetched response and an incoming request body. They have not demonstrated that result on Python or the other affected software. No exploitation outside testing has been reported. [2]
Those limits matter. So does the direction of travel.
Vercel added firewall rules on the day of disclosure, but said they do not cover “responses your functions fetch from other servers.” A service can have protection against hostile incoming requests while its own outbound fetch brings the vulnerable decoder something to unpack. [2]
The week established how far that decoder travels. Google and Node.js released fixes on October 21; Bun, Python packages and proxies each require their own updated copy. Envoy and Istio need Brotli decompression enabled for the flaw to be reachable. Python clients can acquire that behaviour through an installed dependency. A product inventory alone leaves the administrator short of an answer. [2]
There is a related lesson in Sunday’s Tailscale SSH disclosure, although the evidence is less settled. Researcher Erica Windisch reported that SSH port forwarding could make a privileged Tailscale process reach local sockets and obtain root access. The reported attack requires an already compromised device with permission to connect to the target. No independent public reproduction was available, and Tailscale had acknowledged issues under investigation without confirming the specific technical claims. [1]
In Windisch’s lab, access rules naming individual source and destination devices stopped the reported spread. For Brotli, the decisive condition is whether the running program decodes compressed data controlled by somebody else. Both findings make the configured path consequential: an allowed connection can carry input to a component with more authority than the person maintaining the service intended. [1] [2]
For the Python administrator, even the usual dependency alert may be missing. The Hacker News reports that the GitHub advisory still named no affected package, leaving Dependabot without the package mapping it reads. A quiet scanner therefore supplies little evidence about the installed decoder. [2]
Python Brotli 1.2.1 and brotlicffi 1.2.1.0 contain fixes. Dropping `br` from the request’s `Accept-Encoding` header does not by itself prevent a server from sending Brotli anyway. The receiving process must stop decoding untrusted Brotli or run a repaired decoder. [2]
A fixed package in the build configuration does not change the process already serving requests. An affected container must be rebuilt with the repaired dependency and replaced, and the service process restarted, before the next compressed response reaches the released repair. [2]