Brotli Decoder Out-of-Bounds Write Flaw Hits Python Ecosystem
A critical out-of-bounds write flaw in Google's Brotli decoder (versions 1.0.3–1.2.0) exposes the Python ecosystem to pre-auth remote code execution, affecting packages with over 100 million monthly downloads, with proof-of-concept exploits already emerging.
2026-10-24 ~ 2026-10-24 · 2 related posts
- Episode 1: Node.js Ships Security Updates Across 22/24/26 Lines Fixing Brotli RCE(2026-10-21, 10 posts)
- Episode 2: OpenAI red team uncovers unauthenticated RCE in Brotli; patched Node.js releases out(2026-10-23, 6 posts)
- Episode 3: Brotli Decoder Out-of-Bounds Write Flaw Hits Python Ecosystem(2026-10-24, 2 posts)
- Python packages vulnerable to pre-auth RCE via node2shell CVE-2026-111497 through Brotli — cyb3rops · 2026-10-24
- Critical Brotli decoder bug hits PyPI too: Python2Shell joins Node2Shell RCE — banteg · 2026-10-24