{"basis":"claimed","id":"CVE-2026-111497","name":"Google Brotli Unchecked Return Value Vulnerability","vendorProject":"Google","product":"Brotli","publishedAt":"2026-10-22","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"exploited":{"kevAdded":"2026-10-27","dueDate":"2026-11-10","ransomware":false},"epss":{"score":0.82641,"percentile":0.99667,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"log","firstOn":"2026-10-25","daysToRule":3},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"rule","firstOn":"2026-10-26","daysToRule":4},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","cwes":["CWE-787","CWE-252"],"vendors":[{"vendor":"cloudflare","status":"log","basis":"claimed","firstOn":"2026-10-25","firstIsNew":true,"daysToRule":3,"daysAtMost":null,"freePlan":false,"claims":[{"id":"5f5bf39c475b001dc147c32fb0762edc98b2c2a1a63d94582fa5d89998bc132c","cve_id":"CVE-2026-111497","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"8f252673b69d47afb21f88acca706f3c","rule_name":"Brotli - Request Content-Encoding - CVE:CVE-2026-111497","change":"new","default_action":"Log","published_on":"2026-10-25","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/","source_title":"WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset","excerpt":"Brotli - Request Content-Encoding - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"4ffe96e5810e56a4abaed38651119108edaa6098d24a1ac6e72b8213f1ac369a","cve_id":"CVE-2026-111497","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"33dc63d3171649ed8f267455402fe5bb","rule_name":"Next.js - Image Optimizer Path - CVE:CVE-2026-111497","change":"new","default_action":"Log","published_on":"2026-10-25","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/","source_title":"WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset","excerpt":"Next.js - Image Optimizer Path - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.","first_seen_at":"2026-11-02T21:00:14.891Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"rule","basis":"claimed","firstOn":"2026-10-26","firstIsNew":true,"daysToRule":4,"daysAtMost":null,"freePlan":false,"claims":[{"id":"1304fd1347973a1fa92977a2bf5dc6c045086880bfa6eea277b74cf4f28e8159","cve_id":"CVE-2026-111497","vendor":"fastly","product":"Next-Gen WAF","rule_id":null,"rule_name":"Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell)","change":"new","default_action":null,"published_on":"2026-10-26","source_url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-cve-2026-111497/","source_title":"Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell)","excerpt":"Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell). A buffer overflow vulnerability that can lead to remote code execution has been found in the Google Brotli decompression library (versions 1.0.3 through 1.2.0), used by Node.js, Python and other software, and has been assigned CVE-2026-111497. Fastly has created a virtual patch for it that is now available within your account. If you’ve previously enabled the Automatic CVE Virtual Patching setting , we’ve already enabled this vir…","first_seen_at":"2026-11-02T21:00:19.903Z"}]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":10,"first_seen":"2026-10-27T23:41:31.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":2},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":1},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":7}],"top_posts":[{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/gaprogman.com/post/3mzed6v3tcb2j","author":"gaprogman.com","author_name":"Jamie Taylor","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:l57xtcclnxkd3p535queikal/bafkreidudr5aaay2esha3ym3jdktslaqqyobtdtojqfxc7ee7csyns3xda","text":"S09E04b - The October 2026 Brotli Security Update: Who It Affects\r\n\r\nA short bonus episode about Common Vulnerabilities and Exposures (CVE) entry CVE-2026-111497. This is a flaw in the Brotli decompression library that .NET uses. Microsoft released a fix for .NET 8, .NET 9 and .…","engagement":0,"posted_at":"2026-11-02T22:01:28.123Z"},{"source":"x","kind":"post","url":"https://x.com/SecureAnago_JP/status/2117375807169691904","author":"SecureAnago_JP","author_name":"セキュアナゴさん","avatar_url":"https://pbs.twimg.com/profile_images/2114841763131318272/vnPj6r0__bigger.jpg","text":"🚨 【続報】Brotliの脆弱性がNeat会議端末にも影響！修正配信まで暫定対策を\n🐟 危険度：8/10（独自評価）\n📅 発表日：2026年11月2日\n\n━━━━━━━━━━━━\n🔍 何が起きた？\n既報のBrotli脆弱性（CVE-2026-111497）について、Neatが会議端末への影響、修正予定、暫定対策を公表しました。","engagement":0,"posted_at":"2026-11-02T21:58:26.000Z"},{"source":"x","kind":"post","url":"https://x.com/0xbfho/status/2117368538138563037","author":"0xbfho","author_name":"bfho","avatar_url":"https://pbs.twimg.com/profile_images/767131743061172224/vf59arvq_bigger.jpg","text":"boh starred fortbridge/cve-2026-111497-wordpress-pingback-brotli on Github https://t.co/ojWDoBX1xk","engagement":0,"posted_at":"2026-11-02T21:29:32.000Z"},{"source":"hn","kind":"post","url":"https://news.ycombinator.com/item?id=50342016","author":"orblivion","author_name":null,"avatar_url":null,"text":"I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still \"under consideration\" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old ser…","engagement":0,"posted_at":"2026-11-02T19:12:47.000Z"},{"source":"hn","kind":"post","url":"https://news.ycombinator.com/item?id=50321108","author":"tln","author_name":null,"avatar_url":null,"text":"It's not a good look. I pulled in from -proposed this time. Ubuntu was slow on the brotli / CVE-2026-111497 updates as well.","engagement":0,"posted_at":"2026-10-31T23:05:32.000Z"},{"source":"hn","kind":"post","url":"https://news.ycombinator.com/item?id=50267526","author":"gnabgib","author_name":null,"avatar_url":null,"text":"Are you unaware that Node2Shell (cve-2026-111497) got renamed to Broccoli2Shell (reason unjustified)? It's not bigger. Node2Shell = cve-2026-111497 (14 points, 5 days ago) https://news.ycombinator.com/item?id=50203180 Broccoli2Shell (402 points, 4 days ago, 219 comments) https:/…","engagement":0,"posted_at":"2026-10-27T23:49:30.000Z"},{"source":"hn","kind":"post","url":"https://news.ycombinator.com/item?id=50267457","author":"j12y","author_name":null,"avatar_url":null,"text":"Brotli is bigger than node2shell, php2shell or an npm bug. Its copied into runtimes, databases, document readers, image libraries, language bindings, and native packages. (CVE-2026-111497)","engagement":0,"posted_at":"2026-10-27T23:41:31.000Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/fortbridge/cve-2026-111497-wordpress-pingback-brotli","author":"fortbridge","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/75114098?v=4","text":"fortbridge/cve-2026-111497-wordpress-pingback-brotli: Local WordPress pingback/Brotli RCE reproduction with a one-use Podman lab","engagement":3,"posted_at":"2026-11-02T08:55:32.000Z"},{"source":"github","kind":"poc","url":"https://github.com/EQSTLab/CVE-2026-111497","author":"EQSTLab","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/148991397?v=4","text":"EQSTLab/CVE-2026-111497: Node2Shell","engagement":1,"posted_at":"2026-11-02T09:46:41.000Z"},{"source":"github","kind":"poc","url":"https://github.com/ChriSec7/CVE-2026-111497-POC","author":"ChriSec7","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/153367141?v=4","text":"ChriSec7/CVE-2026-111497-POC","engagement":0,"posted_at":"2026-11-02T04:58:58.000Z"}]}}