cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

PHP Rebuilds Windows Packages to Fix Brotli Code-Execution Flaw

· Original article ↗

Summary

PHP rebuilt Windows packages for versions 8.2–8.5 with fixed Brotli 1.2.1 to address CVE-2026-111497, a memory-corruption flaw that can potentially enable code execution when cURL automatically decompresses responses.

Key points

  • The rebuilt PHP Windows packages are 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1; they include Brotli 1.2.1.
  • The flaw can be reached through PHP’s cURL extension when automatic HTTP response decompression is enabled.
  • Guzzle’s cited versions set an empty CURLOPT_ENCODING value by default for cURL requests; The Hacker News says it did not test the behavior on Windows.
  • PHP advises installing the rebuilt packages. OpenAI recommends disabling automatic Brotli decompression until updating; in Guzzle, setting decode_content to false also leaves gzip responses compressed.
  • CISA’s October 23 assessment recorded no exploitation, and PHP’s notice did not mention attacks.

Article Details

Vulnerability Types
  • Memory corruption
  • Remote code execution
Severity
Google rates it Critical (CVSS 4.0, 9.2); Red Hat rates it Important (CVSS 3.1, 8.1).
Affected Versions
  • PHP 8.2–8.5 Windows packages containing Brotli 1.2.0
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Until updating, disable automatic Brotli decompression. In PHP, do not set CURLOPT_ENCODING.
  • In Guzzle, set the decode_content request option to false; this disables automatic decoding of all formats, including gzip.

CVE

CVE-2026-111497PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and

Vendors

GoogleGoogle rates the flaw 9.2 out of 10, or Critical, on the CVSS 4.0 scale. Red Hat rates it 8.1, or Important, on the CVSS 3.1 scale.PHPPHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and

Products

Brotlihas rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory andBunGoogle fixed it in Brotli 1.2.1, 1.1.1 and 1.0.10 when it was first disclosed on October 21. Node.js, Bun and other software that ships its own copy of Brotli have also released fixes.curlPHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.Node.jsImperva researchers ran code through the flaw on one official Node.js build, and it took them several attempts. PHP's notice does not mention any attacks. CISA's assessment of October 23 recorded no exploitation, andPHPPHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and

Related Articles