Hello,
I am investigating whether 3CX V20 running on Debian 12 (Bookworm) is affected by CVE-2026-111497, which concerns a vulnerability in the Brotli decoder.
During my investigation, I found the following on my 3CX system:
System information
3CX V20 on the official Linux ISO
Debian GNU/Linux 12 (Bookworm)
Installed Debian package: libbrotli1 1.0.9-2+b6
Package source: http://repo.3cx.com/debian/2009
Bundled .NET runtime: Microsoft.NETCore.App 10.0.7
Findings
The following file is loaded by the 3cxSystemService process:
/usr/lib/3cxpbx/System.IO.Compression.Brotli.dll
Additionally, the bundled native library:
/usr/lib/3cxpbx/libSystem.IO.Compression.Native.so
contains Brotli-related symbols, including:
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderCreateInstance
BrotliEncoderCompress
The native library does not show a dynamic dependency on the system library libbrotlidec.so.1 when checked with ldd.
I have not yet established whether the bundled Brotli implementation is vulnerable to CVE-2026-111497 or whether any 3CX service processes attacker-controlled Brotli-compressed data through a vulnerable code path.
Questions
Is 3CX V20 on Debian 12 affected by CVE-2026-111497?
Does the bundled .NET runtime 10.0.7 contain a vulnerable Brotli implementation, or does 3CX include a patched version?
Is the bundled libSystem.IO.Compression.Native.so affected by this CVE?
Is a 3CX update planned or already available to address this issue?
Is any mitigation recommended until an official fix is available?
I do not want to replace system libraries or modify the bundled .NET runtime manually, as this is a production PBX.
Any clarification from the 3CX team regarding the vulnerability status and recommended mitigation would be appreciated.
Thank you.
I am investigating whether 3CX V20 running on Debian 12 (Bookworm) is affected by CVE-2026-111497, which concerns a vulnerability in the Brotli decoder.
During my investigation, I found the following on my 3CX system:
System information
3CX V20 on the official Linux ISO
Debian GNU/Linux 12 (Bookworm)
Installed Debian package: libbrotli1 1.0.9-2+b6
Package source: http://repo.3cx.com/debian/2009
Bundled .NET runtime: Microsoft.NETCore.App 10.0.7
Findings
The following file is loaded by the 3cxSystemService process:
/usr/lib/3cxpbx/System.IO.Compression.Brotli.dll
Additionally, the bundled native library:
/usr/lib/3cxpbx/libSystem.IO.Compression.Native.so
contains Brotli-related symbols, including:
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderCreateInstance
BrotliEncoderCompress
The native library does not show a dynamic dependency on the system library libbrotlidec.so.1 when checked with ldd.
I have not yet established whether the bundled Brotli implementation is vulnerable to CVE-2026-111497 or whether any 3CX service processes attacker-controlled Brotli-compressed data through a vulnerable code path.
Questions
Is 3CX V20 on Debian 12 affected by CVE-2026-111497?
Does the bundled .NET runtime 10.0.7 contain a vulnerable Brotli implementation, or does 3CX include a patched version?
Is the bundled libSystem.IO.Compression.Native.so affected by this CVE?
Is a 3CX update planned or already available to address this issue?
Is any mitigation recommended until an official fix is available?
I do not want to replace system libraries or modify the bundled .NET runtime manually, as this is a production PBX.
Any clarification from the 3CX team regarding the vulnerability status and recommended mitigation would be appreciated.
Thank you.
