CVE-2026-111497: Critical Brotli Decoder Vulnerability

Are You Affected?

CVE-2026-111497 affects the Google Brotli decoder, specifically code in c/dec/decode.c. A specially crafted Brotli-compressed stream can trigger the vulnerability. The primary concern is applications that automatically decompress attacker-controlled HTTP, HTTP/2, API, upload, proxy, or other network data.

The affected upstream ranges should be interpreted as follows:

• Brotli 1.0.3 through versions before 1.0.10
• Brotli 1.1.0 through versions before 1.1.1
• Brotli 1.2.0 through versions before 1.2.1

The supplied NVD result does not include the complete CVSS vector string, so individual CVSS metrics should not be inferred beyond the available description. The record describes a remotely reachable, unauthenticated attack path, which explains the high score.

Brotli is frequently bundled into other products rather than installed as a clearly identifiable standalone service. Potentially affected integrations include:

• Node.js
• Python brotli and brotlicffi
• Envoy
• Istio
• .NET-related components
• brotli4j
• Operating-system Brotli packages
• Other applications or libraries that decode attacker-controlled streams

A bundled library does not automatically mean a product is remotely exploitable. Exposure depends on whether the product invokes the vulnerable decoder on untrusted input.

Analyst’s Take: Treat this first as an exposure and dependency-inventory problem, not just a package upgrade. CISA KEV inclusion sets the urgency, but practical risk still depends on whether a service feeds attacker-controlled data into the decoder.

The Fix, If You’re in a Hurry

Upgrade affected upstream Brotli installations to one of the fixed releases identified in the available vulnerability data:

• 1.0.10
• 1.1.1
• 1.2.1

For downstream products, use the vendor’s security release rather than replacing a library manually inside a packaged application. Node.js users should apply the applicable October 2026 security release. Administrators of Python, Envoy, Istio, .NET-related, brotli4j, and operating-system deployments should check their package or vendor advisories for the exact fixed product version.

First identify whether Brotli is dynamically linked or statically bundled. Typical Linux checks include:

# Debian/Ubuntu package inventory
dpkg-query -W -f='${Package}\t${Version}\n' 2>/dev/null | grep -i brotli

# RPM-based package inventory
rpm -qa | grep -i brotli

# Search common application trees for Brotli artifacts
find /opt /srv /usr/local \( -iname '*brotli*' -o -iname '*brotlicffi*' \) 2>/dev/null

If immediate patching is impossible, disable Brotli decoding or restrict untrusted compressed input where the affected product supports that control. For an HTTP service, this may mean temporarily removing br from accepted content encodings or configuring the reverse proxy not to forward Brotli-compressed input to a vulnerable backend. This is a product-specific workaround, not a substitute for upgrading.

Technical Notes

For a source-based Brotli deployment, the operational fix is to build and install a fixed release, then restart every process that loads the library:

git clone https://github.com/google/brotli.git
cd brotli
git checkout v1.2.1
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
sudo cmake --install build
sudo ldconfig
sudo systemctl restart <affected-service>

Validate the repository, release, and build process against your organization’s approved source and package controls. If the application statically bundles Brotli, installing a system library will not remediate it; the application itself must be updated.

How This Vulnerability Works

The vulnerable component is the Brotli decoder in c/dec/decode.c. The issue is described as a buffer overflow or out-of-bounds memory write involving decoder state and an unchecked return value. A maliciously constructed Brotli stream can cause the decoder to mishandle state and corrupt adjacent memory.

The immediate security boundary is the code that accepts and decompresses the stream. In a web stack, that may be a front-end server, reverse proxy, API gateway, application runtime, upload processor, or service-to-service client. If the decoder runs inside a privileged or internet-facing process, the consequences can extend beyond a simple crash.

Potential impacts include corruption of adjacent decoder-state memory, disclosure of sensitive memory contents, denial of service, and potentially arbitrary-code execution. The exact result depends on the integration, compiler, memory layout, mitigations, process privileges, and how the application handles decoded data.

Organizations should not assume that every deployment is exploitable for code execution, but they should also not downgrade the issue to a local-only crash.

Technical Notes

A vulnerable execution path generally has this shape:

attacker-controlled compressed stream
        |
        v
network-facing component accepts Brotli data
        |
        v
Brotli decoder processes stream
        |
        v
decoder state corruption or out-of-bounds write
        |
        +--> crash / denial of service
        +--> sensitive memory disclosure
        +--> possible code execution, depending on context

The flaw is in the decoder rather than in a single application protocol. Consequently, filtering one URL, user agent, or payload pattern is unlikely to provide reliable protection. Attackers can vary compressed streams while preserving the same malicious decoder condition.

Severity, Explained

CVE-2026-111497 has a reported CVSS score of 9.8, placing it in the critical range. The available record identifies a network-reachable attack path with no authentication requirement. It also describes potential impact across confidentiality, integrity, and availability, including memory disclosure, denial of service, and possible arbitrary-code execution.

The full CVSS vector string was not included in the supplied NVD result. Therefore, precise individual metric values should be confirmed in the current NVD record or applicable vendor advisory before they are used in formal risk scoring. The 9.8 score is sufficient to establish that internet-facing and untrusted-input processing paths deserve emergency prioritization.

Severity is also affected by deployment context. A Brotli library used only to decode trusted local files may have a narrower attack surface than a public API gateway or Node.js service accepting remote content. Conversely, a seemingly low-profile library may be embedded in many services, making dependency inventory and transitive-dependency analysis essential.

Is It Being Exploited?

Yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026. That status confirms exploitation in the wild at the catalog level and should be treated as the primary urgency signal. CISA’s remediation due date is November 10, 2026.

The available information does not identify a specific threat actor, campaign, or confirmed ransomware operation. CISA’s ransomware-campaign field is unknown. Secondary reporting has referenced code-execution claims in a Node.js environment, but those reports should not be treated as a substitute for a vendor-confirmed exploit artifact.

A verified public proof-of-concept repository or confirmed exploit code was not identified in the supplied research. The absence of a public PoC does not reduce the priority: KEV inclusion indicates real-world exploitation even when exploit details are limited or not publicly reproducible.

Technical Notes

Treat the following as separate facts during incident triage:

Prioritization Checklist

Use the following sequence to manage CVE-2026-111497:

1. Identify internet-facing services that accept, decompress, or forward Brotli data.
2. Inventory direct and bundled dependencies in hosts, containers, runtimes, lockfiles, and application packages.
3. Determine whether Brotli is dynamically linked or statically bundled.
4. Apply vendor fixes for Node.js, Python, Envoy, Istio, .NET-related components, brotli4j, and operating-system packages.
5. Patch upstream Brotli to 1.0.10, 1.1.1, or 1.2.1 where appropriate.
6. Restart affected processes after patching and verify the loaded library or application build.
7. Temporarily disable untrusted Brotli processing if an approved workaround is available and patching is delayed.
8. Review logs and crash telemetry for suspicious activity before and after remediation.
9. Document exceptions against the November 10, 2026 CISA remediation deadline.