CVE-2026-111497
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
How to fix
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: Nov 10, 2026- brotli1.2.1 or later
- brotlicffi1.2.1.0 or later
- google brotli1.0.10, 1.1.1, 1.2.1 or later
- nodejs node.js22.23.4, 24.22.1, 26.12.1 or later
- python-hyper brotlicffi1.2.1.0 or later
- microsoft .net8.0.33, 9.0.22, 10.0.14 or later
- istio istio1.29.9, 1.30.6, 1.31.2 or later
- anthropic bun1.4.4 or later
- envoyproxy envoy1.37.8, 1.38.6, 1.39.3 or later
- andybalholm brotli1.2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| brotliPyPI | 1.0.3 ≤ v < 1.2.1, v < 1.2.1 | 1.2.1 |
| brotlicffiPyPI | 1.0.3 ≤ v < 1.2.1.0, v < 1.2.1.0 | 1.2.1.0 |
| google brotli | 1.0.3 ≤ v < 1.0.10, 1.1.0 ≤ v < 1.1.1, 1.2.0 ≤ v < 1.2.1 | 1.0.10, 1.1.1, 1.2.1 |
| nodejs node.js | v < 22.23.4, 23.0.0 ≤ v < 24.22.1, 25.0.0 ≤ v < 26.12.1 | 22.23.4, 24.22.1, 26.12.1 |
| python-hyper brotlicffi | v < 1.2.1.0 | 1.2.1.0 |
| microsoft .net | 8.0.0 ≤ v < 8.0.33, 9.0.0 ≤ v < 9.0.22, 10.0.0 ≤ v < 10.0.14, 11.0.0 | 8.0.33, 9.0.22, 10.0.14 |
| debian debian_linux | 12.0 | — |
| istio istio | v < 1.29.9, 1.30.0 ≤ v < 1.30.6, 1.31.0 ≤ v < 1.31.2 | 1.29.9, 1.30.6, 1.31.2 |
| anthropic bun | v < 1.4.4 | 1.4.4 |
| envoyproxy envoy | v < 1.37.8, 1.38.0 ≤ v < 1.38.6, 1.39.0 ≤ v < 1.39.3 | 1.37.8, 1.38.6, 1.39.3 |
| tianocore edk2 | v ≤ 202608 | — |
| google woff2 | No range specified | — |
| duckdb duckdb | v ≤ 2.0.0 | — |
| clickhouse clickhouse | v ≤ 26.10.2.103 | — |
| apache arrow | v ≤ 26.0.0, 27.0.0 | — |
| mcmilk 7-zip-zstd | v ≤ 26.02-1.5.7-r2 | — |
| 7-zip p7zip | v ≤ 16.02 | — |
| andybalholm brotli | v < 1.2.7 | 1.2.7 |
| siemens ruggedcom_ape1808_firmware | No range specified | — |
| siemens common_configurator | No range specified | — |
| siemens data_flow_monitoring | No range specified | — |
| siemens edge_opc_ua_server_configurator | No range specified | — |
| siemens flow_creator_configurator | No range specified | — |
| siemens industrial_edge_cloud_connector_configurator | No range specified | — |
| siemens industrial_edge_databus_configurator | No range specified | — |
| siemens industrial_edge_hub | No range specified | — |
| siemens industrial_edge_management_cloud | No range specified | — |
| microsoft azl3_brotli_1.1.0-2 | No range specified | — |
| microsoft .net_8.0_installed_on_windows | No range specified | — |
| microsoft .net_8.0_installed_on_linux | No range specified | — |
| microsoft .net_8.0_installed_on_mac_os | No range specified | — |
| microsoft .net_9.0_installed_on_windows | No range specified | — |
| microsoft .net_9.0_installed_on_linux | No range specified | — |
| microsoft .net_9.0_installed_on_mac_os | No range specified | — |
| microsoft .net_10.0_installed_on_windows | No range specified | — |
| microsoft .net_10.0_installed_on_linux | No range specified | — |
| microsoft .net_10.0_installed_on_mac_os | No range specified | — |
| microsoft .net_11.0_installed_on_windows | No range specified | — |
| microsoft .net_11.0_installed_on_linux | No range specified | — |
| microsoft .net_11.0_installed_on_mac_os | No range specified | — |
| microsoft microsoft_visual_studio_2019_version_16.11 | No range specified | — |
| microsoft visual_studio_2022 | No range specified | — |
| microsoft microsoft_visual_studio_2026_version_18.11 | No range specified | — |
| microsoft microsoft_visual_studio_2026_version_18.12 | No range specified | — |
| microsoft powershell | No range specified | — |
| microsoft microsoft_visual_studio_2017_version_15.9 | No range specified | — |
| microsoft azl3_p7zip_16.02-23 | No range specified | — |
| microsoft azl3_qemu_10.1.0-2 | No range specified | — |
| microsoft azl3_nodejs_24.21.0-1 | No range specified | — |
| microsoft azl3_qemu_10.1.0-1 | No range specified | — |
| microsoft visual_studio_2017 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.