OpenAI red team finds unauthenticated RCE in widely deployed Brotli compression library
gdb · x · 2026-10-24
OpenAI's red-teaming exercise uncovered an unauthenticated remote code execution vulnerability in Brotli, the compression library embedded in Node.js, Bun, Envoy and many other downstream projects, according to Greg Brockman, who says disclosure and patch coordination are underway.
An attacker can execute code by sending crafted compressed data without any account: unpatched servers accepting compressed input can be taken over by a malicious client, and unpatched clients (e.g. curl --compressed) by a malicious server. The root cause is fixed in Brotli source, but coordinating patches across the deeply integrated dependency ecosystem remains difficult.
Related event: OpenAI Red Team Uncovers Unauthenticated RCE Flaw in Brotli(2 posts)→
More from Infra
- NVIDIA ships BioNeMo Inference Runtime v0.2 with RFD4-Proteina support — AllThingsApx · 2026-10-24
- ISTA-DASLab ships GSQ-RCO quantized DeepSeek-V4.1-Flash GGUFs, llama.cpp support still pending — Gold_Coconut9777 · 2026-10-24
- Sauers_ Mocks OpenAI Over Unstudied Multi-Agent Hardware — Sauers_ · 2026-10-24
- Local quant benchmark: new releases trail months-old DeepSeek/Qwen models — EmilPi · 2026-10-24
- Meta's Muse Spark Open hits ~150M tokens/s per MW on NVIDIA GB300 in early benchmarks — ArtificialAnlys · 2026-10-24
- Musk says no GB300s or even H100s to rent; analyst calls China chip export policy absurd — Gregory_C_Allen · 2026-10-24