Vulnerability Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Brotli | >= 1.0.3, < 1.0.10 | |
| Nodejs | Node.Js | < 22.23.4 |
| Python-Hyper | Brotlicffi | < 1.2.1.0 |
| Microsoft | .Net | >= 8.0.0, < 8.0.33 |
| Debian | Debian Linux | 12.0 |
| Istio | Istio | < 1.29.9 |
| Anthropic | Bun | < 1.4.4 |
| Envoyproxy | Envoy | < 1.37.8 |
| Tianocore | Edk2 | <= 202608 |
| Woff2 | - | |
| Duckdb | Duckdb | <= 2.0.0 |
| Clickhouse | Clickhouse | <= 26.10.2.103 |
| Apache | Arrow | <= 26.0.0 |
| Mcmilk | 7-Zip-Zstd | <= 26.02-1.5.7-r2 |
| 7-Zip | P7Zip | <= 16.02 |
| Andybalholm | Brotli | < 1.2.7 |
| Siemens | Ruggedcom Ape1808 Firmware | - |
| Siemens | Ruggedcom Ape1808 | - |
| Siemens | Common Configurator | - |
| Siemens | Data Flow Monitoring | - |
Related Weaknesses (CWE)
References
- https://github.com/andybalholm/brotli/releases/tag/v1.2.7Release Notes
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-bThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/25Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/24/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/12Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/13Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/16Mailing ListThird Party Advisory
- https://broccoli2shell.comThird Party Advisory
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35Third Party Advisory
- https://github.com/dotnet/announcements/issues/494Issue TrackingMitigationThird Party Advisory
- https://github.com/google/brotli/releases/tag/v1.0.10Release Notes
- https://github.com/google/brotli/releases/tag/v1.1.1Release Notes
- https://github.com/google/brotli/releases/tag/v1.2.1Release Notes
- https://lists.debian.org/debian-lts-announce/2026/10/msg00049.htmlMailing ListThird Party Advisory
- https://patchtheplanet.org/brotliThird Party Advisory
FAQ
What is CVE-2026-111497?
CVE-2026-111497 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decod...
How severe is CVE-2026-111497?
CVE-2026-111497 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-111497?
Check the references section above for vendor advisories and patch information. Affected products include: Google Brotli, Nodejs Node.Js, Python-Hyper Brotlicffi, Microsoft .Net, Debian Debian Linux.