Post

ImportStatic
@importstatic.com

Fiber v2 decodes Brotli request bodies in c.Body(), and a fresh go get of v2.52.16 still resolves andybalholm/brotli v1.1.0. The port's CVE-2026-111497 fix is in v1.2.7. govulncheck reports nothing. https://importstatic.com/go/brotli-cve-2026-111497-go-rust

importstatic.comDoes the Brotli RCE (CVE-2026-111497) reach Go and Rust servers?CVE-2026-111497 is in Brotli's C decoder. Which Go and Rust stacks link it, which frameworks decode br request bodies by default, and the versions to check.

0 reposts0 likes

No replies yet.