Issue Brotli CVE-2026-111497

[pleskuser67553]

Server operating system version

AlmaLinux 9.8 (Olive Jaguar)

Plesk version and microupdate number

Plesk Obsidian 18.0.81 Update #5

Firstly, for anyone new to this extensive info at Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)

Let's start a new thread about this one, as I think it deserves headline attention. Aside from the quotes below, I've not seen much talk about this, but it appears quite an extensive flaw since disclosure last week.

Keep an eye on this Brotli RCE with curl for your servers as well: CVE-2026-111497 | Ubuntu

I have now seen the first attacks on our server.

Regarding the Brotli desaster I want to make you aware that updating the libraries won't be enough (e.g. when your operating system updates them). You'll also need to restart the services that depend on them, and this also applies to the service if it only links dynamically to the Brotli library. The reason is that services load the library when they start. If the library is updated, it does not change in the memory of the service, so the service still uses the previous version that can be attacked.

What you should restart is definitely all php-fpm services. What you normally do not need to restart are Nginx and Apache, as both route incoming traffic through to the endpoint without decompressing it. If you are using Node, Ruby, Bun etc., restarts are required.

On the command line, I'd suggest to run python3 -c "import pkg_resources; [print(f'{d.project_name}: {d.version}') for d in pkg_resources.working_set if d.project_name.lower() in ['brotli', 'brotlicffi']]" once, just to make sure that your Python does not use the Brotli package by default. No output = no problem.

Finally, another piece of unasked advice: Your distributor might backport the updated Brotli files, so that they still carry version numbers that appear to be affected by the flaw. However, you can find out what the real update status is by querying the package manager, for example for Alma/RHEL it would be
rpm -q --changelog brotli | grep -i "CVE-2026-111497" or to see the first few lines rpm -q --changelog brotli | head -n 5.

if I look for brotli on my AlmaLinux 9.8 server I see:

Name        : libbrotli
Version     : 1.0.9
Release     : 10.el9_8
Architecture: x86_64
Install Date: Thu Oct  8 03:35:24 2026

However, if I run @Bitpalast 's suggested rpm queries, I see:

# rpm -q --changelog brotli | grep -i "CVE-2026-111497"
# rpm -q --changelog brotli | head -n 5
package brotli is not installed

So I'm a bit confused at this stage, is my server backport-patched, unpatched?

Is it the responsibility of AlmaLinux, Plesk, or myself to patch?

 

[pleskuser67553]

Ah, I've just seen a new patch arrive today in System Packages for libbrotli 1.0.9-10.el9_8.1 (baseos)

 

[Bitpalast]

So I'm a bit confused at this stage, is my server backport-patched, unpatched?

Is it the responsibility of AlmaLinux, Plesk, or myself to patch?

Probably "libbrotli" instead of just brotli.

The OS vendor will patch, but not individual software like PECL extensions.

 

[pleskuser67553]

Probably "libbrotli" instead of just brotli.

The OS vendor will patch, but not individual software like PECL extensions.

Got ya, thanks. So:

# rpm -q --changelog libbrotli | head -n 5
* Mon Jul 27 2026 Miro Hrončok <[email protected]> - 1.0.9-10
- Accept output_buffer_limit as an alias for max_output_length
  in Decompressor.process() for forward compatibility with upstream 1.2.0
- Resolves: RHEL-221150

And looks like it is the patch from here https://access.redhat.com/errata/RHSA-2026:90495

More updates and reboots ahoy.