CVE-2026-111497
CRITICAL CISA KEV
ACT NOW
Priority: 8.09
BB Relevance:
88/100
Published: 2026-10-22
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
High
Description
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
CISA Known Exploited Vulnerability
Vendor / Product
Google — Brotli
Date Added
2026-10-27
Remediation Due
2026-11-10
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111497
Affected Software (78)
| Vendor | Product | Version |
|---|---|---|
| 7-zip | p7zip | < 16.02 |
| 7-zip | p7zip | < 16.02 |
| Brotli | 1.0.3 < 1.0.10 | |
| Brotli | 1.1.0 < 1.1.1 | |
| Brotli | 1.2.0 < 1.2.1 | |
| Brotli | 1.0.3 < 1.0.10 | |
| Brotli | 1.1.0 < 1.1.1 | |
| Brotli | 1.2.0 < 1.2.1 | |
| andybalholm | brotli | < 1.2.7 |
| andybalholm | brotli | < 1.2.7 |
| anthropic | bun | < 1.4.4 |
| anthropic | bun | < 1.4.4 |
| apache | arrow | < 26.0.0 |
| apache | arrow | 27.0.0 |
| apache | arrow | < 26.0.0 |
| apache | arrow | 27.0.0 |
| clickhouse | clickhouse | < 26.10.2.103 |
| clickhouse | clickhouse | < 26.10.2.103 |
| debian | debian_linux | 12.0 |
| debian | debian_linux | 12.0 |
| duckdb | duckdb | < 2.0.0 |
| duckdb | duckdb | < 2.0.0 |
| envoyproxy | envoy | < 1.37.8 |
| envoyproxy | envoy | 1.38.0 – 1.38.6 |
| envoyproxy | envoy | 1.39.0 – 1.39.3 |
| envoyproxy | envoy | < 1.37.8 |
| envoyproxy | envoy | 1.38.0 – 1.38.6 |
| envoyproxy | envoy | 1.39.0 – 1.39.3 |
| brotli | 1.0.3 – 1.0.10 | |
| brotli | 1.1.0 – 1.1.1 |
Showing 30 of 78 entries
References & Advisories (18)
US Government Resource
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Release Notes
Release Notes
Release Notes
Release Notes
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Issue Tracking
Mitigation
Third Party Advisory