Cyber ·
Brotli CVE-2026-111497 also affects git-remote-https
A post on the oss-sec feed says git-remote-https may be vulnerable to CVE-2026-111497 when libcurl is built with Brotli support, and advises checking CURLOPT_ENCODING in applications.
According to the message published on the oss-sec list by Harry Sintonen on October 26, git-remote-https, the Git HTTPS remote helper, is also vulnerable to CVE-2026-111497 when libcurl was built with Brotli support, a condition that, according to the author, usually occurs in most distributions. The text is a machine translation of the feed and gives no details on severity, affected versions or fixes; these points should be confirmed in the original source.
When searching for vulnerable applications that use libcurl, the author also asks to check CURLOPT_ENCODING, which is an alias of CURLOPT_ACCEPT_ENCODING. Old code still uses that name, so a search only for the current name may miss cases. Rota Nacional does not patch libraries, Git or distributions; this item is informational for teams that maintain software and infrastructure.
Original source: Brotli CVE-2026-111497 também afeta o git-remote-https