EN PT-BR
← Voltar ao feed
critical

Brotli out-of-bounds write CVE-2026-111497 (CVSS 9.2) added to CISA KEV; reachable on stock WordPress via xmlrpc.php pingback

2 fonte(s) · 2 atualização(ões) · publicado 26/10/2026 03:55 · coletado há 2 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 31/10/2026 00:08; os links antigos trazem para cá.

Fontes: patchstack.com ↗ gbhackers.com ↗

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (CVSS 9.2) that affects Brotli 1.0.3–1.2.0 and was fixed on 21 October 2026 in 1.0.10, 1.1.1 and 1.2.1. CISA added it to the KEV catalog on 27 October with a federal deadline of 10 November (patchstack.com). Cloudflare had already shipped two emergency WAF detection rules on 25 October, in Log mode by default (gbhackers.com). Patchstack (30 October) shows the flaw is reachable on default WordPress installs via an unauthenticated pingback.ping call to xmlrpc.php, even though WordPress does not ship Brotli (patchstack.com). Public tooling reliably causes denial of service from a sub-100-byte payload. Working RCE chains exist only against specific non-PIE Node.js/Bun builds, not PHP/Apache/FPM (patchstack.com).

Entenda a falha

A vulnerabilidade

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (CVSS 9.2) affecting Brotli 1.0.3 through 1.2.0, fixed on 21 October 2026 in 1.0.10, 1.1.1 and 1.2.1. On stock WordPress it is reachable without authentication: a pingback.ping POST to xmlrpc.php makes WordPress fetch an attacker URL, and the attacker's server answers with a malformed Brotli body that libcurl decodes. The reliable outcome is denial of service (killed or CPU-pinned workers); memory disclosure and code execution are harder. CISA added it to KEV on 27 October with a 10 November deadline.

Como funciona

A pingback.ping request to xmlrpc.php carries a source URL, and pingback_ping() fetches it with wp_safe_remote_get(), through WP_Http and the Requests cURL transport. That transport sets CURLOPT_ENCODING to an empty string, so libcurl accepts any compression. The attacker's server replies with Content-Encoding: br and a malformed stream, which libcurl decompresses inside curl_exec() before any PHP code sees the body. At that step the decoder writes past the end of its buffer into adjacent heap memory, and the worker crashes or hangs.

Por que é vulnerável

The root cause is an out-of-bounds write in the Brotli decoder when handling a malformed stream. It is exposed in WordPress because the cURL transport always asks libcurl to decode any compression (decompress => false does not change that), and because the reject_unsafe_urls SSRF filter in wp_safe_remote_get() only checks internal IPs and ports, never Content-Encoding. The xmlrpc_enabled filter gates only authenticated methods, so pingback stays reachable. The payload arrives in the response, so WAFs inspecting the request cannot see it. The articles do not detail the code change in the fix.

Onde está

The flaw is in the Brotli decoder (libbrotlidec), reached via libcurl; on the WordPress side the route runs through pingback_ping(), wp_safe_remote_get() and the Requests cURL transport constructor setting CURLOPT_ENCODING. No fixing commit is named.

Como foi descoberta

The articles do not say who found the flaw or how it was reported. They state that Google assigned the CVE and scored it 9.2, the fix was released on 21 October 2026, and CISA added it to KEV on 27 October, which indicates exploitation. Cloudflare shipped WAF detection rules on 25 October without giving severity or exploitation details. Patchstack published its WordPress exposure analysis on 30 October, and a lab write-up on 27 October demonstrated the pingback path.

PoC pública

Public proofs of concept are circulating. For the WordPress path, a lab published on 27 October drives the bug through pingback and shows a worker killed outright or pinned at 100% CPU by a payload under a hundred bytes; its author says no code execution is included and blind remote RCE is not established. Working shells exist against specific non-PIE Node.js and Bun builds, relying on fixed offsets, but not against PHP behind Apache or FPM. Denial of service is trivially reproducible, so patch urgently; RCE against PHP is not public but could be built per build.

Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 00:23.

Detalhes técnicos

  • The attack path: an attacker sends a pingback.ping POST, WordPress fetches an attacker-controlled URL, and the attacker's server replies with a malformed Brotli body that libcurl decompresses inside curl_exec() before any PHP code sees it (patchstack.com).
  • WordPress's bundled Requests cURL transport sets CURLOPT_ENCODING to an empty string on every handle, so libcurl accepts any compression. decompress => false does not prevent this (patchstack.com).
  • pingback.ping is in the default XML-RPC method map and needs no authentication. pingback_ping() uses wp_safe_remote_get(), whose reject_unsafe_urls SSRF filter never inspects Content-Encoding. The common xmlrpc_enabled filter gates only authenticated methods, so pingback stays reachable (patchstack.com).
  • Other reachable paths include oEmbed, feeds, and plugins that fetch visitor-supplied URLs, such as link previews, importers, webhook verifiers and avatar proxies (patchstack.com).
  • WAFs cannot detect the WordPress attack because the malicious payload arrives in the server's response, not the inbound request (patchstack.com).
  • Cloudflare rule suffix …ca706f3c matches requests with Content-Encoding: br (a Brotli-encoded request body). It does not match Accept-Encoding: br, and Cloudflare's Brotli response-compression settings are unchanged (gbhackers.com).
  • Cloudflare rule suffix …402fe5bb matches requests to the /_next/image endpoint used for Next.js image optimization, covering legitimate and malicious image requests alike (gbhackers.com).
  • Both Cloudflare rules also match legitimate traffic, so a match does not confirm an exploitation attempt (gbhackers.com).
  • Host indicators: Apache AH00051: child pid N exit signal Segmentation fault (11), PHP-FPM children exiting on signal 11, core dumps with libbrotlidec.so in the backtrace, pinned workers, and outbound responses with Content-Encoding: br (patchstack.com).

Remediação

  • Update Brotli to 1.0.10, 1.1.1 or 1.2.1, or apply the distribution libbrotli1 security update. Debian/Ubuntu backport fixes, so version strings still read 1.1.0. Check the package revision: 1.1.0-2+b7 is vulnerable, 1.1.0-2+deb13u1 is patched (patchstack.com).
  • wordpress:latest still installs a vulnerable libbrotli1, so upgrade the package in your own Docker layer (patchstack.com).
  • Mitigation via mu-plugin: hook http_api_curl, set CURLOPT_ENCODING to identity and CURLOPT_HTTP_CONTENT_DECODING to 0 (patchstack.com).
  • Unset pingback.ping and pingback.extensions.getPingbacks via the xmlrpc_methods filter, and/or deny xmlrpc.php at Apache/nginx (patchstack.com).
  • Audit plugins that fetch user-supplied URLs and route outbound HTTP through an allowlisting proxy (patchstack.com).
  • Before switching the Cloudflare rules to Block, review analytics for matches. Existing ruleset-level overrides set to Block apply immediately on deployment regardless of the Log default, so review them first or use rule-specific Log overrides. Blocking the Next.js rule may stop optimized images from loading (gbhackers.com).

Relatos divergentes

  • Exploitation status: the Cloudflare announcement (gbhackers.com, 26 October) gave no severity score, affected versions or evidence of active exploitation. The later Patchstack analysis (patchstack.com, 30 October) supplies the CVSS 9.2 score, the affected and fixed versions, and the CISA KEV listing of 27 October, which indicates exploitation. Treat the later, more detailed report as authoritative.

Linha do tempo

  1. patchstack.com ↗ · pub. 30/10/2026 06:53 · coletado 30/10 08:01

    CVE-2026-111497: Brotli out-of-bounds write reachable from stock WordPress via xmlrpc.php pingback

    ler a análise desta fonte

    Patchstack details how CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder (CVSS 9.2), is reachable on default WordPress installs even though WordPress does not ship Brotli. An unauthenticated pingback.ping POST to xmlrpc.php makes WordPress fetch an attacker-controlled URL; the attacker's server replies with a malformed Brotli-compressed body that libcurl decompresses inside curl_exec() before any PHP code sees it. The flaw affects Brotli 1.0.3–1.2.0, fixed on 21 October 2026 in 1.0.10, 1.1.1 and 1.2.1; CISA added it to the KEV catalog on 27 October with a federal deadline of 10 November. Public tooling reliably achieves denial of service (crashed or 100%-CPU-pinned workers from a sub-100-byte payload); working RCE chains exist only against specific non-PIE Node.js/Bun builds, not PHP/Apache/FPM. WAFs cannot detect the attack because the malicious payload arrives in the server's response, not the inbound request.

    Technical Details

    • WordPress's bundled Requests cURL transport sets CURLOPT_ENCODING to an empty string on every handle, instructing libcurl to accept and unpack any compression; decompress => false does not prevent this.
    • pingback.ping is in the default XML-RPC method map and requires no authentication; pingback_ping() fetches the supplied source URL with wp_safe_remote_get(), whose reject_unsafe_urls SSRF filter never inspects Content-Encoding.
    • The common xmlrpc_enabled filter only gates authenticated methods and leaves pingback reachable; only edge blocking or unregistering the method closes the route.
    • Other reachable paths include oEmbed, feeds, and any plugin fetching visitor-supplied URLs (link previews, importers, webhook verifiers, avatar proxies).
    • Host indicators: Apache AH00051: child pid N exit signal Segmentation fault (11), PHP-FPM children exiting on signal 11, core dumps with libbrotlidec.so in the backtrace, pinned workers, and outbound responses with Content-Encoding: br.

    Remediation

    • Update Brotli to 1.0.10, 1.1.1 or 1.2.1, or apply the distribution libbrotli1 security update; Debian/Ubuntu backport so version strings still read 1.1.0 — check package revision (1.1.0-2+b7 vulnerable vs 1.1.0-2+deb13u1 patched).
    • wordpress:latest still installs a vulnerable libbrotli1; upgrade the package in your own Docker layer.
    • Mitigation via mu-plugin: hook http_api_curl and set CURLOPT_ENCODING to identity and CURLOPT_HTTP_CONTENT_DECODING to 0.
    • Unset pingback.ping and pingback.extensions.getPingbacks via the xmlrpc_methods filter, and/or deny xmlrpc.php at Apache/nginx.
    • Audit plugins that fetch user-supplied URLs and route outbound HTTP through an allowlisting proxy.
  2. gbhackers.com ↗ · pub. 26/10/2026 03:55 · coletado 26/10 04:00 primeiro registro

    Cloudflare ships emergency WAF detection rules in Log mode for Brotli flaw CVE-2026-111497, including Next.js image endpoint

    ler a análise desta fonte

    Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026, adding two detection rules for the Brotli vulnerability CVE-2026-111497. The rules sit in the Cloudflare Managed Ruleset and are enabled in Log mode by default, so they give visibility without blocking traffic. Both rules also match legitimate traffic, so a match does not confirm an exploitation attempt. The announcement gives no affected software versions, severity score, exploitation prerequisites, exploit payloads or evidence of active exploitation.

    Technical Details

    • Rule suffix …ca706f3c matches requests carrying the header Content-Encoding: br, meaning a Brotli-encoded request body. It does not match Accept-Encoding: br, and Cloudflare's response-compression settings for Brotli are unchanged.
    • Rule suffix …402fe5bb matches requests to the /_next/image endpoint used for Next.js image optimization. It covers legitimate image requests as well as malicious ones.
    • Existing ruleset-level action overrides set to Block would apply to the new rules immediately on deployment, regardless of the default Log action. This can cause false positives.

    Remediation

    • Review analytics for matches before switching either rule to Block.
    • Review existing ruleset-level overrides before deployment. For a cautious rollout, use rule-specific Log overrides first.
    • Be careful with the Next.js rule: blocking it may stop optimized images from loading.
    • Take particular care for applications that accept Brotli request bodies or serve images through Next.js optimization.