AI analysis
Claude Opus · 6 Nov 2026, 10:20 CET
Brotli decoder memory corruption flaw under active exploitation across many products
A critical memory corruption flaw in the Brotli decompression library lets unauthenticated remote attackers crash, read memory from, or potentially take over applications that decompress untrusted data. It is listed in CISA KEV. Update Brotli and every bundling product now.
In plain terms
Brotli is a widely used compression format, often used to shrink web traffic and files. Many programs include Google's Brotli library to unpack (decompress) this data, including Node.js, .NET, Envoy, Istio, Bun, ClickHouse, DuckDB, Apache Arrow, 7-Zip variants, firmware projects and several Siemens industrial products. The flaw is in the part of Brotli that unpacks data. A specially crafted compressed stream can make the decoder write outside the memory it is supposed to use. This is called a buffer overflow or out-of-bounds write.
An attacker who can get such a stream into a vulnerable program, for example by sending it over the network, may be able to crash the program, read sensitive data from its memory, or possibly run their own code on the machine. No login or user action is needed. CISA has confirmed real-world exploitation. Any organisation running the listed software, especially internet-facing services that accept compressed input, should treat this as urgent.