CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

KEV

Analyzed

AliasesDEBIAN-CVE-2026-111497UBUNTU-CVE-2026-111497PYSEC-2026-4322+480 more

Published 22-10-2026Last modified 28-10-2026

Vulnerability summary

CVE-2026-111497 is a critical (CVSS 9.8) Unchecked Return Value vulnerability in Google Brotli. It is known to be exploited: CISA lists it, first on 27-10-2026. EPSS estimates a 87.99% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (27-10-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

87.99%

0%100%

Critical · Change unavailable

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 1 · Downstream 1 · Related 1

GHSA-9V8H-QQGM-4M35 OPENSUSE-SU-2026:12248-1

Timeline

22-10-2026
PublishedVulnerability first disclosed.
27-10-2026
Added to CISA KEVExploitedGoogle Brotli Unchecked Return Value Vulnerability
28-10-2026
Last modifiedVulnerability information updated.
10-11-2026
CISA remediation dueUpcomingApply mitigations per vendor instructions.

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS metrics

9 scores · 8 sources · 2 versions

v4.09.2v3.19.8

EPSS trend

Probability

87.99%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Change unavailable

23-10-202628-10-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 27-10-2026
Federal due date: 10-11-2026

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. nvd.nist.gov/vuln/detail/CVE-2026-111497

Public exploits

1 found

referenceUnverified
Exploit Reference (imperva.com)
Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard195 products

actions-runner< 2.338.1-r2
airflow-2< 2.11.2-r27
altinity-clickhouse-22.8< 22.8.20.12-r3
altinity-clickhouse-23.3< 23.3.19.33-r2
altinity-clickhouse-23.8< 23.8.16.43-r3

altinity-clickhouse-24.3< 24.3.18.10426-r2
altinity-clickhouse-24.8< 24.8.14.10549-r2
altinity-clickhouse-25.3< 25.3.14.10001-r2
altinity-clickhouse-25.8< 25.8.33.10001-r2
altinity-clickhouse-26.3< 26.3.53.10001-r1
altinity-clickhouse-keeper-22.8< 22.8.20.12-r3
altinity-clickhouse-keeper-23.3< 23.3.19.33-r2
altinity-clickhouse-keeper-23.8< 23.8.16.43-r3
altinity-clickhouse-keeper-24.3< 24.3.18.10426-r2
altinity-clickhouse-keeper-24.8< 24.8.14.10549-r2
altinity-clickhouse-keeper-25.3< 25.3.14.10001-r2
altinity-clickhouse-keeper-25.8< 25.8.33.10001-r2
altinity-clickhouse-keeper-26.3< 26.3.53.10001-r1
apache-beam-python-3.11-sdk< 2.77.0-r4
apache-beam-python-3.12-sdk< 2.77.0-r6
apache-beam-python-3.13-sdk< 2.77.0-r6
apache-beam-python-3.14-sdk< 2.77.0-r6
apicurio-registry< 3.3.3-r9
apicurio-registry-3-operator< 3.3.3-r9
apicurio-registry-3-operator-fips< 3.3.3-r6
apicurio-registry-fips< 3.3.3-r6
azure-functions-dotnet-worker< 2.52.0-r4
brotli< 1.2.0-r7
brotli-static< 1.2.0-r7
brunsli< 0.1-r8
bun< 1.4.4-r0
bun-bootstrap< 1.4.4-r0
cilium-1.17-envoy< 1.17.18-r18
cilium-1.18-envoy< 1.18.15-r0
cilium-1.19-envoy< 1.19.9-r0
cilium-1.20-envoy< 1.20.3-r0
cilium-envoy-fips-1.17< 1.17.18-r13
cilium-envoy-fips-1.18< 1.18.15-r0
cilium-envoy-fips-1.19< 1.19.9-r0
cilium-envoy-fips-1.20< 1.20.3-r0
cilium-fips-1.20-envoy< 1.20.3-r0
clickhouse-25.8< 25.8.33.6-r2
clickhouse-26.1< 26.1.12.23-r12
clickhouse-26.2< 26.2.19.43-r11
clickhouse-26.3< 26.3.60.2-r1
clickhouse-26.4< 26.4.5.143-r7
clickhouse-26.5< 26.5.7.64-r5
clickhouse-26.6< 26.6.8.7-r3
clickhouse-26.7< 26.7.37.6-r1
clickhouse-26.8< 26.8.34.13-r1
clickhouse-fips-25.8< 25.8.33.6-r2
clickhouse-fips-26.1< 26.1.12.23-r10
clickhouse-fips-26.2< 26.2.19.43-r11
clickhouse-fips-26.3< 26.3.60.2-r1
clickhouse-fips-26.4< 26.4.5.143-r7
clickhouse-fips-26.5< 26.5.7.64-r4
clickhouse-fips-26.6< 26.6.8.7-r1
clickhouse-fips-26.7< 26.7.37.6-r1
clickhouse-fips-26.8< 26.8.34.13-r1
clickhouse-keeper-25.8< 25.8.33.6-r2
clickhouse-keeper-26.1< 26.1.12.23-r12
clickhouse-keeper-26.2< 26.2.19.43-r11
clickhouse-keeper-26.3< 26.3.60.2-r1
clickhouse-keeper-26.4< 26.4.5.143-r7
clickhouse-keeper-26.5< 26.5.7.64-r5
clickhouse-keeper-26.6< 26.6.8.7-r3
clickhouse-keeper-26.8< 26.8.34.13-r1
clickhouse-keeper-fips-25.8< 25.8.33.6-r2
clickhouse-keeper-fips-26.1< 26.1.12.23-r10
clickhouse-keeper-fips-26.2< 26.2.19.43-r11
clickhouse-keeper-fips-26.3< 26.3.60.2-r1
clickhouse-keeper-fips-26.6< 26.6.8.7-r1
clickhouse-keeper-fips-26.7< 26.7.37.6-r1
dagster< 1.13.26-r2
datahub-ingestion< 1.8.0-r1
datawire-envoy-1.31< 1.31.10-r3
datawire-envoy-1.31-privileged< 1.31.10-r3
datawire-envoy-1.37< 1.37.5-r3
datawire-envoy-1.37-privileged< 1.37.5-r3
dbgate< 7.3.2-r1
dbgate-fips< 7.3.2-r2
dbt-bigquery< 1.10.3-r12
dotnet-10-runtime< 10.0.113-r3
dotnet-10-targeting-pack< 10.0.113-r3
dotnet-8-runtime< 8.0.132-r2
dotnet-8-targeting-pack< 8.0.132-r2
dotnet-sdk-10.0.1-artifacts< 10.0.113-r1
dotnet-sdk-10.0.2-artifacts< 10.0.204-r10
dotnet-sdk-10.0.3-artifacts< 10.0.303-r7
dotnet-sdk-10.0.4-artifacts< 10.0.402-r2
drain-cleaner< 1.8.0-r2
duckdb< 2.0.0-r1
envoy-1.35< 1.35.13-r8
envoy-1.36< 1.36.12-r0
envoy-1.37< 1.37.8-r0
envoy-1.38< 1.38.6-r0
envoy-1.39< 1.39.3-r0
envoy-fips-1.35< 1.35.13-r4
envoy-fips-1.36< 1.36.12-r0
envoy-fips-1.37< 1.37.8-r0
envoy-fips-1.38< 1.38.6-r0
envoy-fips-1.39< 1.39.3-r0
firefox< 150.0-r0
firefox-esr< 140.10.1-r0
floci-az< 0.15.0-r2
gftools< 0.10.4-r3
graalvm-25-ce-nodejs< 25.0.4.1-r8
graalvm-25.1-ce-nodejs< 25.1.3-r3
graalvm-25.2-ce-nodejs< 25.2.4-r3
hono-adapter-mqtt< 2.7.0-r48
hono-service-auth< 2.7.0-r48
hono-service-command-router< 2.7.0-r48
hono-service-device-registry-jdbc< 2.7.0-r48
howdy-csharp< 2.4-r13
istio-envoy-1.28< 1.28.10-r3
istio-envoy-1.29< 1.29.9-r0
istio-envoy-1.30< 1.30.6-r0
istio-envoy-1.31< 1.31.2-r0
istio-envoy-fips-1.28< 1.28.10-r3
istio-envoy-fips-1.29< 1.29.9-r0
istio-envoy-fips-1.30< 1.30.6-r0
istio-envoy-fips-1.31< 1.31.2-r0
jitsucom-bulker-bulker< 2.15.0-r11
jitsucom-bulker-sidecar< 2.15.0-r11
jupyter-all-spark-notebook< 7.6.1_git20261023-r1
kates< 1.29.3-r1
kates-fips< 1.29.3-r1
katib-suggestion-nas-enas< 0.19.0-r48
katib-tfevent-metricscollector< 0.19.0-r48
keycloak-26.6< 26.6.7-r7
keycloak-26.6-iamguarded-compat< 26.6.7-r7
keycloak-26.6-operator< 26.6.7-r7
keycloak-26.7< 26.7.5-r1
keycloak-26.7-iamguarded-compat< 26.7.5-r1
keycloak-26.7-operator< 26.7.5-r1
keycloak-26.8-iamguarded-compat< 26.8.1-r2
keycloak-fips-26.6< 26.6.7-r11
keycloak-fips-26.6-iamguarded-fips< 26.6.7-r11
keycloak-fips-26.6-operator< 26.6.7-r11
keycloak-fips-26.7< 26.7.5-r4
keycloak-fips-26.7-iamguarded-fips< 26.7.5-r4
keycloak-fips-26.7-operator< 26.7.5-r4
keycloak-fips-26.8< 26.8.1-r3
keycloak-fips-26.8-iamguarded-fips< 26.8.1-r3
keycloak-fips-26.8-operator< 26.8.1-r3
kibana-8.19< 8.19.18-r0
kibana-8.19-bitnami< 8.19.18-r0
kibana-8.19-iamguarded< 8.19.18-r0
kibana-9.2< 9.2.8-r29
kibana-9.3< 9.3.7-r0
kibana-9.3-iamguarded< 9.3.7-r0
kibana-9.4< 9.4.3-r0
kibana-9.4-iamguarded< 9.4.3-r0
kserve-huggingfaceserver-cuda-13.3< 0.21.0-r7
kserve-lgbserver< 0.21.0-r3
kserve-lgbserver-fips< 0.21.0-r3
kserve-pmmlserver< 0.21.0-r3
kserve-pmmlserver-fips< 0.21.0-r4
kserve-xgbserver< 0.21.0-r4
kserve-xgbserver-fips< 0.21.0-r4
kubeflow-pipelines-visualization-server< 2.17.2-r9
label-studio< 1.23.2-r3
libbrotlidec1< 1.2.0-r7
libduckdb2.0< 2.0.0-r1
librechat< 0.8.8-r7
libtensorflow2< 2.21.0-r9
lmcache-cuda-12.8< 0.5.6-r2
lmcache-cuda-13.0< 0.5.6-r2
locust< 2.47.0-r1
locust-fips< 2.47.0-r1
longhorn-engine-1.10< 1.10.2-r24
longhorn-engine-1.11< 1.11.3-r16
longhorn-engine-1.12< 1.12.1-r12
longhorn-engine-1.8< 1.8.2-r31
longhorn-engine-1.9< 1.9.2-r33
maxscale-21.06< 21.06.21-r8
maxscale-22.08< 22.08.19-r11
maxscale-23.02< 23.02.16-r13
maxscale-23.08< 23.08.12-r10
maxscale-24.02< 24.02.8-r8
maxscale-24.08< 24.08.0-r7
maxscale-fips-21.06< 21.06.21-r10
maxscale-fips-23.02< 23.02.16-r12
maxscale-fips-23.08< 23.08.12-r11
maxscale-fips-24.02< 24.02.8-r9
mitmproxy< 12.3.0-r1
mlflow< 3.17.2-r1
mlflow-fips< 3.17.2-r1
mlrun< 1.12.1-r3
mlrun-api< 1.12.1-r3
mono< 6.14.1-r4
nemo-gym< 0.5.0_rc0_git20260729-r7
nemo-rl-cuda-13.0< 0.7.0-r12
nemo-rl-cuda-13.0-automodel< 0.7.0-r12
nemo-rl-cuda-13.0-mcore< 0.7.0-r12

Show all 195

7-zip1 product

p7zip≤ 16.02

Alpine1 product

brotli< 1.1.1-r0 | < 1.2.1-r0

Andybalholm1 product

brotli< 1.2.7

Anthropic1 product

bun< 1.4.4

Apache1 product

arrow≤ 26.0.0 | 27.0.0:dev

6 vendors · 200 products · Showing 200 of 368

References

42 links

security-tracker.debian.org/tracker/CVE-2026-111497Advisory
nodejs.org/en/blog/vulnerability/october-2026-security-releasesPatchREPORTWEBFIXThird Party Advisory
ubuntu.com/security/CVE-2026-111497REPORT
www.cve.org/CVERecord?id=CVE-2026-111497REPORTAdvisoryWEB
www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/Exploit
github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2bFIXWEB
opensourcemalware.com/blog/node2shell-affects-pythonWEB
nodejs.org/en/blog/vulnerability/october-2026-security-releasesWEB
github.com/google/brotli/releases/tag/v1.2.1WEBRelease Notes
pypi.org/project/Brotli/PACKAGE

Show all 42 references

pypi.org/project/brotlicffi/PACKAGE
security.alpinelinux.org/vuln/CVE-2026-111497Advisory
github.com/advisories/GHSA-9v8h-qqgm-4m35AdvisoryThird Party Advisory
www.openwall.com/lists/oss-security/2026/10/23/25WEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2026/10/msg00049.htmlWEBMailing ListThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2026-111497Advisory
github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0WEB
github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6WEB
github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12WEB
pypi.org/project/brotlicffiWEB
pypi.org/project/BrotliWEB
github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yamlWEB
github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yamlWEB
github.com/google/brotli/releases/tag/v1.1.1WEBRelease Notes
github.com/google/brotli/releases/tag/v1.0.10WEBRelease Notes
github.com/google/brotliPACKAGE
www.suse.com/security/cve/CVE-2026-111497WEB
www.openwall.com/lists/oss-security/2026/10/24/6WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2026/10/26/12WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2026/10/26/13WEBMailing ListThird Party Advisory
www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497ARTICLEThird Party Advisory
broccoli2shell.comWEBThird Party Advisory
github.com/dotnet/announcements/issues/494REPORTIssue TrackingMitigationThird Party Advisory
patchtheplanet.org/brotliWEBThird Party Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111497.jsonAdvisory
www.openwall.com/lists/oss-security/2026/10/26/16WEBMailing ListThird Party Advisory
ubuntu.com/security/notices/USN-8956-1Advisory
github.com/andybalholm/brotli/releases/tag/v1.2.7Release NotesThird Party Advisory
ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497Government ResourceUS Government Resource
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
ubuntu.com/security/notices/USN-8956-2Advisory