Brotli CVE-2026-111497 and git-remote-https
// AI summary
git-remote-https is vulnerable to CVE-2026-111497 when libcurl is built with brotli support, which is common across most distributions.
// from the source
Posted by Harry Sintonen on Oct 26 I haven t seen this mentioned here, yet: git https remote (git-remote-https) is vulnerable to CVE-2026-111497, too, when libcurl has been built with brotli support (generally this is the case for most distros). When scanning for vulnerable apps using libcurl also check for CURLOPT_ENCODING since this is an alias for CURLOPT_ACCEPT_ENCODING. Fair bit of older code still uses this old option name. (*) *)...