Security statement: Brotli decoder vulnerability (CVE-2026-111497)
Last updated: October 30, 2026
Based on our assessment, Flexmonster Software does not expose the vulnerable Brotli decoder to attacker-controlled input. Flexmonster Data Server and the Flexmonster Admin Panel nevertheless include affected decoders in their bundled runtimes. We will release updated versions with patched runtimes by November 2, 2026.