From d66af81e28eacb0342b3ab6db642471797a601e1 Mon Sep 17 00:00:00 2001 From: Chris Oaldon Date: Tue, 10 Nov 2026 11:59:27 -0500 Subject: [PATCH] docs: add CVE-2026-111497 Brotli note to README Co-Authored-By: Claude Opus 5.5 --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index be80ea3..42d0adb 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,9 @@ For details about the Postmark API in general, see the **[Postmark developer doc - Python 3.10+ +> **Security:** the Brotli decoder is affected by [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497). `httpx` requests and decodes Brotli only when the optional +> `brotli` or `brotlicffi` package is installed. If you have either, use `brotli` >= 1.2.1 or `brotlicffi` >= 1.2.1.0. + ## Installation Install from PyPI as **`postmark-python`** (the Python package you import is still **`postmark`**):