CVE-2026-111497
published 2026-10-22CVE-2026-111497: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-11-10
Exploited in the wild
EPSS
82.64%
99.7th percentile
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 7-zip | p7zip | <= 16.02 | — |
| andybalholm | brotli | < 1.2.7 | 1.2.7 |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| anthropic | bun | < 1.4.4 | 1.4.4 |
| apache | arrow | <= 26.0.0 | — |
| apache | arrow | — | — |
| clickhouse | clickhouse | <= 26.10.2.103 | — |
| debian | brotli | — | — |
| debian | debian_linux | — | — |
| duckdb | duckdb | <= 2.0.0 | — |
| envoyproxy | envoy | < 1.37.8 | 1.37.8 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.6 | 1.38.6 |
| envoyproxy | envoy | >= 1.39.0 < 1.39.3 | 1.39.3 |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| brotli | >= 1.0.3 < 1.0.10 | 1.0.10 | |
| brotli | >= 1.1.0 < 1.1.1 | 1.1.1 | |
| brotli | >= 1.2.0 < 1.2.1 | 1.2.1 | |
| istio | istio | < 1.29.9 | 1.29.9 |
| istio | istio | >= 1.30.0 < 1.30.6 | 1.30.6 |
| istio | istio | >= 1.31.0 < 1.31.2 | 1.31.2 |
| mcmilk | 7-zip-zstd | <= 26.02-1.5.7-r2 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.2CRITICAL
cisa9.2CRITICAL
vendor_redhat9.2CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Google Brotli Unchecked Return Value Vulnerability
cisa·2026-10-27·CVSS 9.2
CVE-2026-111497 [CRITICAL] CWE-252 Google Brotli Unchecked Return Value Vulnerability
Vulnerability: Google Brotli Unchecked Return Value Vulnerability
Affected: Google Brotli
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluat
Red Hat
brotli: Out-of-Bounds Write in Google Brotli Decoder
vendor_redhat·2026-10-22·CVSS 9.2
CVE-2026-111497 [CRITICAL] CWE-787 brotli: Out-of-Bounds Write in Google Brotli Decoder
brotli: Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can l
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
Palo Alto
Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
vendor_paloalto·CVSS 9.2
CVE-2026-111497 [CRITICAL] CWE-787 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.
Palo Alto Networks is actively investigating i
GHSA
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
ghsa_unreviewed·2026-11-01·CVSS 9.8
CVE-2026-115946 [CRITICAL] XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.
XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
GHSA
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decod
ghsa_unreviewed·2026-10-22
CVE-2026-111497 [CRITICAL] CWE-252 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decod
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
VulnCheck
Google brotli Unchecked Return Value
vulncheck·2026·CVSS 9.2
CVE-2026-111497 [CRITICAL] Google brotli Unchecked Return Value
Google brotli Unchecked Return Value
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected: Google brotli
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://ellio.tech/en/blog/node2shell-cve-2026-1114
No detection rules found.
No public exploits indexed.
Hackernews
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
blogs_hackernews·2026-10-28·CVSS 9.8
CVE-2026-111497 [CRITICAL] Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause
Eset
Lessons from Cybersecurity Black Week
blogs_eset·2026-10-28·CVSS 9.8
CVE-2026-109618 [CRITICAL] Lessons from Cybersecurity Black Week
The week leading up to October 25, 2026, was every cyber defender’s nightmare: a barrage of critical vulnerabilities in PHP and the Linux kernel, a compromised LiteLLM release, a maximum-severity flaw in GitLab, a Node.js Brotli flaw, and a certificate authority incident affecting TLS trust.
A few years ago, a backlog like this would have filled a defender’s to-do list for a whole month. In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October. AI-assisted research helped uncover at least two of these flaws: PHP2Shell and the Brotli bug. On top of the breakneck patching pace, security teams faced mounting pressure to deliver status reports to other departments, management, cust
Hackernews
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
blogs_hackernews·2026-10-27·CVSS 9.8
CVE-2026-109618 [CRITICAL] CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.
The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -
CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
CVE-2026-109619 - A stale internal request-state vulnerability that
Tenable
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
blogs_tenable·2026-10-26·CVSS 9.2
CVE-2026-111497 [CRITICAL] Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
## Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.
## Key Takeaways
CVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA), scored 9.2 under CVSSv4.0.
Any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk, including Node.js, .NET, Bun, Envoy Proxy, Istio,
Hackernews
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
blogs_hackernews·2026-10-26·CVSS 9.2
CVE-2026-111497 [CRITICAL] PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.
8.5.12-1
8.4.27-1
8.3.36-1
8.2.35-1
PHP publishes a software bill of materials , a list of
Hackernews
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
blogs_hackernews·2026-10-26·CVSS 9.8
CVE-2026-109618 [CRITICAL] ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.
And that's not even the full story. A leaked key led to a software supply-chain attack. AI agents are being tricked into following harmful instructions. Old bugs are still being used to break into systems, and some att
Wiz
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
blogs_wiz·2026-10-25·CVSS 9.2
CVE-2026-111497 [CRITICAL] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
A critical vulnerability, tracked as CVE-2026-111497 and referred to as Broccoli2Shell, has been identified in the Brotli decompression library. The vulnerability affects multiple widely used technologies, including Node.js, Bun, Envoy Proxy, and more. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE).
Organizations using affected components to decompress untrusted Brotli-compressed data are advised to prioritize remediation.
CVE-2026-111497 was discovered and reported by Khai Tran and Sylvie Mayer (OpenAI Codex Security), with fixes implemented by Matteo Collina and Antoine du Hamel (Node.js). Ron Masas (Imperva Red Team) demonst
Hackernews
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
blogs_hackernews·2026-10-25·CVSS 9.2
CVE-2026-111497 [CRITICAL] OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.
"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," the artificial intelligence (AI) company said . "We've implemented this policy and will maintain it until advances in these safeguards just
Hackernews
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
blogs_hackernews·2026-10-24·CVSS 9.2
CVE-2026-111497 [CRITICAL] Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.
Tracked as CVE-2026-111497 , the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.
Imperva researchers have shown that code can run on one unpatched Node.js build . The same
Hackernews
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
blogs_hackernews·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.
Their " Node2Shell " proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder ( CVE-2026-111497 ). Node.js disclosed the flaw and released fixes on October 21 , and applications that decode untrusted Brotli data should update.
Imperva's test did not succeed on every attem
Bugzilla
[Major Incident] CVE-2026-111497 dotnet8.0: Out-of-Bounds Write in Google Brotli Decoder [fedora-all]
bugzilla·2026-10-27·CVSS 9.2
CVE-2026-111497 [CRITICAL] [Major Incident] CVE-2026-111497 dotnet8.0: Out-of-Bounds Write in Google Brotli Decoder [fedora-all]
[Major Incident] CVE-2026-111497 dotnet8.0: Out-of-Bounds Write in Google Brotli Decoder [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available vers
Bugzilla
Missing CVE-2026-111497 Patch for NodeJS22
bugzilla·2026-10-26·CVSS 9.2
CVE-2026-111497 [CRITICAL] Missing CVE-2026-111497 Patch for NodeJS22
Missing CVE-2026-111497 Patch for NodeJS22
Releases: 43/44/45/46
Fixed in 22.23.4
Supplied version: 22.22.2 (F43)
caused by CVE-2026-111497 in Brotli Decoder
Request: CritPath Update to stable asap.
Note: it spread to python and other implementation.
Source:
https://broccoli2shell.com/
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion:
from the devs who found the bug..
"Update October 26: Patches are now available for Node.js, Bun, Envoy, Istio, .NET, Python, Java brotli4j, libbrotli and several Linux distributions, including Debian, Alpine and Amazon Linux. Ubuntu, SUSE and the standard Red Hat Enterprise Linux repositories don’t have a fix yet. For Node.js (including 18 and 20) and Ubuntu, Aikido patched container images are av
Bugzilla
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-f45]
bugzilla·2026-10-24·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-f45]
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-f45]
+++ This bug was initially created as a clone of Bug #2559478 +++
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.
Bugzilla
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1
Bugzilla
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10
Bugzilla
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1
Bugzilla
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10
Bugzilla
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10
Bugzilla
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.
Bugzilla
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1
Bugzilla
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1
Bugzilla
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.
Bugzilla
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.1
Bugzilla
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1
Bugzilla
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10
Bugzilla
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version:
Bugzilla
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.1
Bugzilla
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-10]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-10]
CVE-2026-111497 qt6-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
CVE-2026-111497 qt5-qtwebengine: Out-of-Bounds Write in Google Brotli Decoder [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.
Bugzilla
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 mingw-qt5-qtwebkit: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.
Bugzilla
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
bugzilla·2026-10-23·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
CVE-2026-111497 mingw-brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or
Bugzilla
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
bugzilla·2026-10-22·CVSS 9.2
CVE-2026-111497 [CRITICAL] CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
https://github.com/andybalholm/brotli/releases/tag/v1.2.7https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---highhttp://www.openwall.com/lists/oss-security/2026/10/23/25http://www.openwall.com/lists/oss-security/2026/10/24/6http://www.openwall.com/lists/oss-security/2026/10/26/12http://www.openwall.com/lists/oss-security/2026/10/26/13http://www.openwall.com/lists/oss-security/2026/10/26/16https://broccoli2shell.comhttps://github.com/advisories/GHSA-9v8h-qqgm-4m35https://github.com/dotnet/announcements/issues/494https://github.com/google/brotli/releases/tag/v1.0.10https://github.com/google/brotli/releases/tag/v1.1.1https://github.com/google/brotli/releases/tag/v1.2.1https://lists.debian.org/debian-lts-announce/2026/10/msg00049.htmlhttps://patchtheplanet.org/brotlihttps://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497https://cert-portal.siemens.com/productcert/html/ssa-045512.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-443410.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-898633.htmlhttps://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
2026-10-22
Published
2026-10-27
Added to CISA KEV
Exploited in the wild