Brotli CVE-2026-111497 (GHSA-9v8h-qqgm-4m35) in Python: are requests, urllib3, httpx and aiohttp affected through the Brotli / brotlicffi packages, and what do I upgrade?

Am I affected? CVE-2026-111497 is a critical (CVSS 4.0: 9.2) out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. Crafted compressed data can corrupt memory in whatever process decompresses it. The Node.js fix shipped on October 21. The Python packages are affected too: - PyPI Brotli 1.0.3-1.2.0 (fixed in 1.2.1) - PyPI brotlicffi 1.0.3-1.2.0.x (fixed in 1.2.1.0) You don't have to import Brotli yourself. If either package is installed, urllib3 (and therefore requests), httpx with the brotli extra, aiohttp and Scrapy advertise 'br' and automatically decode Brotli responses from any server you call. Servers and proxies that decode Brotli request bodies are exposed to inbound traffic too. Other places that bundle the C decoder include the system libbrotli, Bun 1.4.3 and earlier, and copies inside .NET, PHP, Ruby, DuckDB and ClickHouse, which need their own updates. How to check: - pip show Brotli brotlicffi in every virtualenv, and inside images: docker run --rm <image> pip show Brotli brotlicffi - pipdeptree -r -p Brotli shows what pulled it in; also grep lockfiles (poetry.lock, uv.lock, requirements*.txt) for brotli. - System library: dpkg -l | grep -i brotli / rpm -qa | grep -i brotli. - Early on, some scanners (pip-audit, Dependabot) didn't yet map the CVE to these PyPI packages, so check versions directly instead of trusting a clean scan. Fix: - pip install -U 'Brotli>=1.2.1' and/or 'brotlicffi>=1.2.1.0', then update the lockfile. - C library: Google's fixed releases are 1.0.10, 1.1.1 and 1.2.1. Install your distro's security update for libbrotli/brotli. - Bun: upgrade past 1.4.3. Node.js: 22.23.4 / 24.22.1 / 26.12.1. - Rebuild container images and restart every long-running process (workers, agents, proxies). A loaded old library stays in memory until restart. Interim mitigation: - Uninstall Brotli and brotlicffi if you don't need them: HTTP clients fall back to gzip/deflate. - Or stop advertising Brotli (remove 'br' from Accept-Encoding) and have your edge or load balancer reject Brotli-encoded request bodies. After fixing: - Re-run pip show inside the running container or host, not just on your laptop. - Check that bundled copies in other runtimes you use (PHP, Ruby, .NET, databases) have vendor updates, and apply them as they ship. Sources: https://github.com/advisories/GHSA-9v8h-qqgm-4m35 https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/ https://nodejs.org/en/blog/release/v24.22.1