Vulnerability CVE-2026-111497: Out-of-bounds write in Brotli bundled with PHP on Plesk for Windows

Situation

A vulnerability in the Google Brotli decompression library, CVE-2026-111497, has been discovered. It is an out-of-bounds write in the Brotli decoder affecting Brotli versions 1.0.3 through 1.2.0, and it is fixed in Brotli 1.0.10, 1.1.1 and 1.2.1.

The Windows builds of PHP bundle Brotli as a dependency of the cURL extension. As a result, the PHP versions shipped with Plesk for Windows are also affected.

Affected Product versions

Impact

The vulnerability is rated Critical (CVSS v4.0 score 9.2). A crafted Brotli-compressed stream can corrupt memory in the PHP process. This can lead to a crash, disclosure of memory contents, or potentially remote code execution.

On Windows, the vulnerable code can only be reached through the PHP cURL extension when automatic decompression of HTTP responses is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it. For example, Guzzle enables it with its default settings.

An attack requires a crafted response from a server that the PHP application connects to. Incoming requests to a website do not trigger the vulnerability by themselves.

There are no known reports of active exploitation.

Call to action

Install the updated PHP packages released on 27 October 2026. They include Brotli 1.2.1. The update is listed in the Change Log for Plesk Obsidian under “PHP Updates – 27 October 2026”.

1. Log into Plesk

2. Go to Tools & Settings > Updates and install the available updates. 

   Alternatively, run the following command in an elevated Command Prompt:

   C:\> plesk installer --select-release-current --upgrade-installed-components

Mitigations (optional)

If the update cannot be installed immediately, reduce exposure as follows:

1. In PHP applications that use cURL, do not enable automatic response decompression. Leave the CURLOPT_ENCODING / CURLOPT_ACCEPT_ENCODING option unset.
2. In applications that use Guzzle, set the decode_content request option to false.

Note: Removing br from the Accept-Encoding request header alone is not sufficient, because a remote server can still send a Brotli-compressed response.

How to verify that a server is patched

Because the PHP version number does not change, check the Brotli version bundled with each PHP handler instead.

1. Connect to the server via RDP

2. Run PowerShell as Administrator and run the following command for each installed PHP handler. PHP 8.4 is used in this example:

   PS & "$env:plesk_dir\Additional\PleskPHP84\php.exe" -r '$v = curl_version(); echo $v[''brotli_version''];'

3. Check the output:

   brotli/1.2.1 means the handler is patched.

   brotli/1.2.0 or earlier means the handler is affected. Install the updates as described in the Call to action section.