I haven't seen this mentioned here, yet: git https remote (git-remote-https)
is vulnerable to CVE-2026-111497, too, when libcurl has been built with
brotli support (generally this is the case for most distros).
When scanning for vulnerable apps using libcurl also check for
CURLOPT_ENCODING since this is an alias for CURLOPT_ACCEPT_ENCODING. Fair
bit of older code still uses this old option name. (*)
*)
https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/http.c#L2284
Regards,
--
l=2001;main(i){float o,O,_,I,D;for(;O=I=l/571.-1.75,l;)for(putchar(--l%80?
i:10),o=D=l%80*.05-2,i=31;_=O*O,O=2*o*O+I,o=o*o-_+D,o+_+_<4+D&i++<87;);puts
(" Harry 'Piru' Sintonen <[email protected]> https://www.iki.fi/sintonen";);}
