Open
Description
Problem Statement
Brotli is only half-supported by Google anyway, and appears "somewhat underspecified".
The python Brotli package (which builds on C libraries) had an RCE in it till 1.2.0.
There is some reason to think this might not be the last security problem in that package.
sentry-python is, AFAICT, the only sentry SDK that actually uses brotli (when it is available).
Getting rid of this would (eventually) allow for sentry-server / relay to be able to stop accepting brotli and not be affected by its problems.
--
disclosure: I'm the maintainer of a Sentry-compatible Error Tracker who's quite eager to be able to drop brotli support himself.
Reacted by Michiel W. Beijen and Bryan Lee
Metadata
Metadata
Assignees
Projects
- StatusShow more project fieldsWaiting for: Product Owner
Activity
linear-code commentedon Oct 24, 2026
PY-3038