Brotli vulnerability affects curl and Git

Re:Brotli vulnerability affects curl and Git by altairprime on Friday October 23, 2026 @01:06PM (#50212180)

Elsewhere in this thread, they note that anyone decoding brotli responses is vulnerable, which would impact Apache/nginx conditionally; I can think of load balancer / proxy scenarios where that’s the case, as well as dynamic IP blocklisting as some use in-server, so duly noted for HN sysadmins.

[ Parent | on HN ]

Re:Brotli vulnerability affects curl and Git by Bender on Friday October 23, 2026 @03:35PM (#50214232)

The nginx brotli module compresses outbound traffic. How would someone exploit brotli on nginx in this scenario? Is there PoC code that could be used against an nginx server that has the Brotli module enabled?

[ Parent | on HN ]

Re:Brotli vulnerability affects curl and Git by altairprime on Friday October 23, 2026 @09:04PM (#50217423)

If you combine nginx brotli with nginx reverse proxy to a backend server that uses brotli-compressed responses, then you would have an opportunity for attack through this mechanism, assuming you could get your payload through both layers and back.

[ Parent | on HN ]

Re:Brotli vulnerability affects curl and Git by cowlevel on Friday October 23, 2026 @09:54PM (#50217695)

Just compress your POST request payload with it. The endpoint doesn't even have to accept POST requests

[ Parent | on HN ]

Re:Brotli vulnerability affects curl and Git by altairprime on Sunday October 25, 2026 @04:04PM (#50235532)

Sure, that’s fine too

[ Parent | on HN ]