Brotli: “Do we use it?” can be a difficult question

You may never have chosen Brotli. It can still be part of software your organisation depends on.

The decoder vulnerability disclosed in October 2026, CVE-2026-111497, affects applications that decompress attacker-controlled Brotli data. Depending on the application, the consequences can include a crash, memory disclosure or remote code execution.

For the person responsible for a business service, the immediate challenge is often finding the right person to ask.

Our advice: identify the services and suppliers involved, ask whether a vulnerable decoder is reachable, and get a clear answer on remediation. Include software that bundles its own dependencies.

Microsoft’s guidance illustrates why this matters: some deployed applications need rebuilding and redeploying; updating the machine’s shared runtime alone may leave the vulnerable component in place.

Give each affected service an owner—and give that person enough support to close the work.