Security statement: Brotli decoder vulnerability (CVE-2026-111497)
Last updated: November 2, 2026
Based on our assessment, Flexmonster Software does not expose the vulnerable Brotli decoder to attacker-controlled input. Flexmonster Data Server and the Flexmonster Admin Panel nevertheless included affected decoders in their bundled runtimes. We released version 2.9.142 with patched runtimes on November 2, 2026.