git-remote-https also hit by Brotli flaw CVE-2026-111497
Original title: Brotli CVE-2026-111497 and git-remote-https
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
Harry Sintonen told oss-security that Git's HTTPS remote helper, git-remote-https, is also vulnerable to CVE-2026-111497 when libcurl was built with Brotli support. He said that configuration is common on most distributions. He advised scanners to treat CURLOPT_ENCODING as an alias for CURLOPT_ACCEPT_ENCODING because older code still uses the former name. The post is cut off and does not describe the flaw's impact or a fix.
Unconfirmed: The snippet does not state what CVE-2026-111497 allows or whether it is exploited.
- The poster says most distributions build libcurl with Brotli.
- CURLOPT_ENCODING is an alias for CURLOPT_ACCEPT_ENCODING.
- Older applications may still set the old option name.
- No affected or fixed version is given in the snippet.
| Product | Affected |
|---|---|
| git-remote-https | — |
| curl libcurl with Brotli | — |
- 1.When scanning libcurl applications, also check CURLOPT_ENCODING, an alias for CURLOPT_ACCEPT_ENCODING.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
Posted by Harry Sintonen on Oct 26 I haven't seen this mentioned here, yet: git https remote (git-remote-https) is vulnerable to CVE-2026-111497, too, when libcurl has been built with brotli support (generally this is the case for most distros). When scanning for vulnerable apps using libcurl also check for CURLOPT_ENCODING since this is an alias for CURLOPT_ACCEPT_ENCODING.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.