Share story
Security

Brotli flaw extends beyond Node.js to Python and other HTTP software

Brotli flaw extends beyond Node.js to Python and other HTTP software Image: Primary
A critical Brotli decompression flaw affects Python packages and other HTTP software beyond Node.js, security company Aikido reported on October 23. Crafted compressed data can corrupt memory, leak information, crash a process or potentially execute code. Both clients accepting malicious responses and servers decoding malicious requests can be exposed. Patches include Brotli 1.2.1 and brotlicffi 1.2.1.0, alongside fixes for multiple runtimes and proxies. Applications bundling vulnerable copies need rebuilt releases. Aikido said advisory databases had not yet mapped the flaw to the Python packages, leaving pip-audit, Dependabot and Safety unable to flag them.
Sources
aikido.dev
Published by Tech & Business, a media brand covering technology and business. This story was sourced from aikido.dev and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
Security Infrastructure
Security Infrastructure

PHP releases fixes for two critical runtime vulnerabilities

PHP has released patches for two critical vulnerabilities that can expose applications to unauthenticated remote code execution and memory disclosure, Google Cloud said October 21. CVE-2026-109618 and CVE-2026-109619 affect PHP 5....

Cloud Blog
AI Security
AI Security

OpenAI says frontier training runs now use an offline web environment

OpenAI says all its frontier reinforcement learning runs now use cached and indexed web content instead of live internet access, PCMag Middle East reports. The environment lets models practice browsing, searching and using web app...

PCMag Middle East
Policy Security
Policy Security

EU opens Booking.com probe over fraudulent listings and phishing

The European Commission has opened a Digital Services Act investigation into Booking Holdings' Booking.com, Reuters reported. Regulators will examine whether the hotel reservation platform is doing enough to combat fraudulent list...

Techmeme