Skip to content
Fencer Vulns
critical 9.8

CVE-2026-111497 kev in the critical feed json

Out-of-Bounds Write in Google Brotli Decoder

published 2026-10-22 17 d ago modified 2026-11-06 2 d ago also BIT-brotli-2026-111497 , BIT-dotnet-2026-111497 , BIT-dotnet-sdk-2026-111497 , BIT-node-2026-111497 , BIT-node-min-2026-111497 , BIT-powershell-2026-111497 , EUVD-2026-108169 , GHSA-9v8h-qqgm-4m35 , GHSA-c9gr-gmg4-2vqv , GO-2026-6888 , PYSEC-2026-4322 , PYSEC-2026-4323

cvss
9.8
version 3.1, NVD
cisa kev
Exploited
added 2026-10-27
epss
82.6%
EPSS 82.6% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • pypi brotli 1.2.1
  • pypi brotlicffi 1.2.1.0
  • bitnami brotli 1.0.10, 1.1.1, 1.2.1
  • bitnami dotnet 8.0.33, 9.0.22, 10.0.14
  • bitnami dotnet-sdk 8.0.33, 9.0.22, 10.0.14
  • bitnami node 22.23.4, 24.22.1, 26.12.1
  • bitnami node-min 22.23.4, 24.22.1, 26.12.1
  • bitnami powershell 7.4.22, 7.5.13, 7.6.9
  • go github.com/andybalholm/brotli 1.2.7
  • Google Brotli 1.0.10, 1.1.1, 1.2.1
  • Siemens Cloud Connector Configurator V1.24.3
  • Siemens Data Flow Monitoring V3.0.18
  • Siemens Databus Configurator V4.0.1
  • Siemens DataXess Configurator V1.5.7
  • Siemens Edge OPC UA Server Configurator V2.3.10
  • Siemens Flow Creator Configurator V1.15.1
  • Siemens Gridscale X DSA V5.4
  • Siemens Gridscale X PSS®E V36.8.0
  • brotli Debian 12 1.0.9-2+deb12u1
  • brotli Debian 13 1.1.0-2+deb13u1
  • brotli Debian 14 1.2.0-4.1
  • python-brotlicffi Debian 14 1.2.1.0+ds-1

debian advisories DEBIAN-CVE-2026-111497

  • brotli Ubuntu 22.04 LTS 1.0.9-2ubuntu0.1
  • brotli Ubuntu 24.04 LTS 1.1.0-2ubuntu0.1
  • brotli Ubuntu 26.10 1.2.0-4ubuntu0.1
  • brotli Ubuntu 26.04 LTS 1.2.0-3ubuntu0.1
  • dotnet8 Ubuntu 22.04 LTS 8.0.133-8.0.33-0ubuntu1~22.04.1
  • dotnet8 Ubuntu 24.04 LTS 8.0.133-8.0.33-0ubuntu1~24.04.1
  • dotnet10 Ubuntu 24.04 LTS 10.0.114-10.0.14-0ubuntu1~24.04.1
  • dotnet10 Ubuntu 26.10 10.0.114-10.0.14-0ubuntu1~26.10.1

ubuntu advisories UBUNTU-CVE-2026-111497

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-Brotli SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.1.0-150400.7.11.1
  • nodejs24 SLE Module for Web and Scripting 15 SP7 24.22.1-150700.15.21.1
  • nodejs22 SLE Module for Web and Scripting 15 SP7 22.23.4-150700.3.21.1
  • brotli Linux Micro 6.2 1.1.0-160000.3.1
  • brotli Linux Micro 6.1 1.1.0-slfo.1.1_2.1
  • brotli Linux Micro 6.0 1.1.0-159998.1.1
  • brotli SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 1.0.7-150200.3.8.1
  • nodejs22 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 22.23.4-150600.13.27.1

suse advisories SUSE-SU-2026:5125-1SUSE-SU-2026:5037-1SUSE-SU-2026:5036-1SUSE-SU-2026:24518-1SUSE-SU-2026:4957-1SUSE-SU-2026:24556-1

  • python-autobahn openSUSE Tumbleweed 26.11.1-1.1
  • brotli openSUSE Leap 16.0 1.1.0-160000.3.1
  • nodejs22 openSUSE Leap 16.0 22.23.4-160000.1.1
  • python-Brotli openSUSE Leap 16.0 1.2.1-160000.1.1
  • trufflehog openSUSE Tumbleweed 3.99.7-1.1
  • ghostscript openSUSE Tumbleweed 10.08.0-3.1
  • python-Brotli openSUSE Tumbleweed 1.2.1-1.1
  • brotli openSUSE Tumbleweed 1.2.1-1.1

opensuse advisories openSUSE-SU-2026:12439-1openSUSE-SU-2026:22213-1openSUSE-SU-2026:22210-1openSUSE-SU-2026:22183-1openSUSE-SU-2026:12353-1openSUSE-SU-2026:12322-1

  • npm AlmaLinux 8 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
  • nodejs AlmaLinux 8 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
  • nodejs-libs AlmaLinux 8 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
  • nodejs-nodemon AlmaLinux 8 3.1.14-2.module_el8.10.0+4250+09238ed4
  • nodejs-full-i18n AlmaLinux 8 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • npm AlmaLinux 9 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075

almalinux advisories ALSA-2026:92376ALSA-2026:92378ALSA-2026:92420ALSA-2026:92428ALSA-2026:92492ALSA-2026:90449

  • dotnet8.0 Rocky Linux 9 8.0.133-1.el9_8
  • dotnet8.0 Rocky Linux 10 8.0.133-1.el10_2
  • dotnet8.0 Rocky Linux 8 8.0.133-1.el8_10
  • nodejs Rocky Linux 9 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
  • nodejs-nodemon Rocky Linux 9 3.1.14-3.module+el9.8.0+40281+14cc6568
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525

rocky linux advisories RLSA-2026:92492RLSA-2026:92428RLSA-2026:92420RLSA-2026:92378RLSA-2026:92376RLSA-2026:90449

  • brotli Alpine 3.21 1.1.1-r0
  • brotli Alpine 3.24, Alpine 3.23 1.2.1-r0
  • nodejs-current Alpine 3.24 26.12.1-r0

alpine advisories ALPINE-CVE-2026-111497

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • brotli Azure Linux 3.0 1.2.1-1
  • nodejs Azure Linux 3.0 24.22.1-1

azure linux advisories AZL-110384AZL-111041

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-111497 updated cvss 8.1

brotli: Out-of-Bounds Write in Google Brotli Decoder

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9, exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform/automation-dashboard-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 native-linux-x86_64 Red Hat build of Apicurio Registry 3 native-linux-x86_64 Red Hat build of Debezium 3 native-linux-x86_64 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9
    +7 more products
    Red Hat Developer Hub 2 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat JBoss Core Services jbcs-httpd24-brotli Red Hat OpenShift AI (RHOAI) rhoai/odh-mlserver-cuda-rhel9 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9 Red Hat Satellite 6 satellite/iop-remediations-rhel9
    affected: workaround, no fix available “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python3.12-brotli 1.2.1-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python3.12-brotli 1.2.1-1.el9ap
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93065
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-brotli 1.2.1-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-brotli 1.2.1-1.el9ap
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:94100
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/ee-supported-rhel9 1793123621
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:92856
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-brotli 1.2.1-1.el9ap
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:94101
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/ee-supported-rhel9 1793362297
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:94108
  • Red Hat Build of Apache Camel 3.33.4.SP2 native-linux-x86_64 1.24.0.redhat-00001
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93980
  • Red Hat build of Quarkus 3.27.6.SP2
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93908
show 18 more
  • Red Hat build of Quarkus 3.33.4.SP2
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93902
  • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts 8.0.133-1.el9_6
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93457
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1793733716
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:94802
  • Red Hat Enterprise Linux AppStream (v. 8) firefox 140.10.0-1.el8_10, dotnet8.0 8.0.133-1.el8_10, python3-brotli 1.0.6-5.el8_10, thunderbird 140.10.0-1.el8_10, dotnet-sdk-8.0 8.0.133-1.el8_10, dotnet-hostfxr-8.0 8.0.33-1.el8_10, +16 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:92420
  • Red Hat Enterprise Linux AppStream (v. 9) brotli 1.0.9-10.el9_8.1, firefox 140.10.0-1.el9_7, dotnet8.0 8.0.133-1.el9_8, firefox-x11 140.10.0-1.el9_7, thunderbird 140.10.0-1.el9_7, dotnet-sdk-8.0 8.0.133-1.el9_8, +18 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:10757
  • Red Hat Enterprise Linux AppStream (v. 10) brotli 1.1.0-8.el10_2.1, firefox 140.10.0-1.el10_1, dotnet8.0 8.0.133-1.el10_2, thunderbird 140.10.0-1.el10_2, dotnet-sdk-8.0 8.0.133-1.el10_2, python3-brotli 1.1.0-8.el10_2.1, +10 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:10767
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.10.0-1.el8_4, thunderbird 140.10.0-1.el8_4, python3-brotli 1.0.6-4.el8_4.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90892
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.10.0-1.el8_6, thunderbird 140.10.0-1.el8_6, python3-brotli 1.0.6-4.el8_6.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90893
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox 140.10.0-1.el8_6, thunderbird 140.10.0-1.el8_6
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:19542
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.10.0-1.el8_8, thunderbird 140.10.0-1.el8_8, python3-brotli 1.0.6-4.el8_8.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90891
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox 140.10.0-1.el9_0, thunderbird 140.10.0-1.el9_0
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:17687
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) brotli 1.0.9-6.el9_2.3, firefox 140.10.0-1.el9_2, firefox-x11 140.10.0-1.el9_2, thunderbird 140.10.0-1.el9_2, python3-brotli 1.0.9-6.el9_2.3
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90914
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) brotli 1.0.9-6.el9_4.3, dotnet8.0 8.0.133-1.el9_4, dotnet-host 8.0.33-1.el9_4, dotnet-sdk-8.0 8.0.133-1.el9_4, python3-brotli 1.0.9-6.el9_4.3, dotnet-hostfxr-8.0 8.0.33-1.el9_4, +10 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93456
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) brotli 1.1.0-6.el10_0.3, firefox 140.10.0-1.el10_0, dotnet8.0 8.0.133-1.el10_0, thunderbird 140.10.0-1.el10_0, dotnet-sdk-8.0 8.0.133-1.el10_0, python3-brotli 1.1.0-6.el10_0.3, +10 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93455
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox 140.10.0-1.el9_4, firefox-x11 140.10.0-1.el9_4, thunderbird 140.10.0-1.el9_4
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:19464
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) brotli 1.0.9-7.el9_6.3, firefox 140.10.0-1.el9_6, dotnet8.0 8.0.133-1.el9_6, firefox-x11 140.10.0-1.el9_6, thunderbird 140.10.0-1.el9_6, dotnet-sdk-8.0 8.0.133-1.el9_6, +11 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:93457
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.10.0-1.el8_4, thunderbird 140.10.0-1.el8_4, python3-brotli 1.0.6-4.el8_4.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90892
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) python3-brotli 1.0.6-4.el8_6.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90893

33 more fixed, 26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
13 d ago
Patch by
2026-11-10 (in 20 h)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
Google, Brotli
CISA name
Google Brotli Unchecked Return Value Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
17 d ago

Exploit prediction

82.64% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi brotli
>=1.0.3, <1.2.1
<1.2.1
1.2.1
pypi brotlicffi
>=1.0.3, <1.2.1.0
<1.2.1.0
1.2.1.0
bitnami brotli
>=1.0.3, <1.0.10
>=1.1.0, <1.1.1
>=1.2.0, <1.2.1
1.0.10
1.1.1
1.2.1
bitnami dotnet
>=8.0.0, <8.0.33
>=9.0.0, <9.0.22
>=10.0.0, <10.0.14
8.0.33
9.0.22
10.0.14
bitnami dotnet-sdk
>=8.0.0, <8.0.33
>=9.0.0, <9.0.22
>=10.0.0, <10.0.14
8.0.33
9.0.22
10.0.14
bitnami node
<22.23.4
>=23.0.0, <24.22.1
>=26.0.0, <26.12.1
22.23.4
24.22.1
26.12.1
bitnami node-min
<22.23.4
>=23.0.0, <24.22.1
>=26.0.0, <26.12.1
22.23.4
24.22.1
26.12.1
bitnami powershell
>=7.4.0, <7.4.22
>=7.5.0, <7.5.13
>=7.6.0, <7.6.9
7.4.22
7.5.13
7.6.9
go github.com/andybalholm/brotli
<1.2.7
1.2.7

Affected products

  • Google Brotli
  • Siemens Cloud Connector Configurator
  • Siemens Common Configurator (CC on IEM)
  • Siemens Common Configurator on Device (CC on Edge)
  • Siemens Data Flow Monitoring
  • Siemens Databus Configurator
  • Siemens DataXess Configurator
  • Siemens Desigo CC family V8
  • Siemens Desigo CC family V9
  • Siemens Edge OPC UA Server Configurator
  • Siemens Flow Creator Configurator
  • Siemens Gridscale X DSA
  • Siemens Gridscale X PSS®E
  • Siemens Heliox Dual Port 60kW
  • Siemens Heliox Flex Pro
  • Siemens Industrial Edge Hub
  • Siemens Industrial Edge Management Cloud
  • Siemens SICHARGE FLEX
  • Siemens SICHARGE UC
  • Siemens Sifinity Go
  • Siemens Sifinity Setup
  • Siemens VersiCharge AC Series
  • Siemens VersiCloud
  • Siemens RUGGEDCOM APE1808

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.