Google Brotli Unchecked Return Value Vulnerability
What's happening and what to do
A remote attacker can send a specially crafted Brotli-compressed stream to corrupt memory, read sensitive memory contents, crash the program, or possibly run arbitrary code, and this flaw is being actively exploited. PyPI packages brotli (versions 1.0.3 up to 1.2.1) and brotlicffi (versions 1.0.3 up to 1.2.1.0). Upgrade brotli to 1.2.1 and brotlicffi to 1.2.1.0 now, and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Affected versions
| Ecosystem | Package | Affected | Safe from |
|---|---|---|---|
| PyPI | brotli | >= 1.0.3 < 1.2.1 | 1.2.1 |
| PyPI | brotlicffi | >= 1.0.3 < 1.2.1.0 | 1.2.1.0 |
Signals over time
- 2026-10-27Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-11-03 21:55First seen here.
- 2026-11-10Federal patch deadline for US agencies.
Source text
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.