OpenAI discloses unauthenticated remote code execution vulnerability in Brotli

What happened

OpenAI says its red-teaming exercise uncovered a Brotli vulnerability allowing unauthenticated remote code execution through malicious compressed data, potentially compromising unpatched clients or servers. The root cause was fixed in February, but its security implications were unrecognized and no newer Brotli release was available; downstream software and its users also need updates. OpenAI disclosed the flaw to Brotli and downstream projects, which released or are releasing security updates, while Brotli issued new releases and published a CVE. Patch and mitigation details: https://patchtheplanet.org/brotli

Read next

• More changes in today’s briefingKimi K3.1 Pro ranks fourth on Artificial Analysis, approaching Claude Opus 5.5

The story so far

OpenAI disclosed a Brotli vulnerability that it said allows unauthenticated remote code execution through malicious compressed data; Brotli has issued new releases and published a CVE, while downstream projects including Node.js have released or are releasing security updates. OpenAI said it found the flaw during a red-teaming exercise. The root cause had been fixed in February, but the security implications were not recognized at the time, and no newer Brotli release was available before the disclosure. According to OpenAI, malicious compressed data could compromise unpatched clients or servers, and downstream software and its users also need updates.