Google Brotli Unchecked Return Value Vulnerability

Exploited · KEV 2026-10-27Public exploit code Trending #2CVE-2026-111497CWE-787CWE-252

Exploited since 2026-10-27. 2 of 8 rule sources name it. 3 public exploit repos.

Edge rules

2/8

Our test

No exploit yet

CVSS

9.2

EPSS

82.6% Top 0.3%

Posts, 14d

Published

2026-10-22

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Edge coverage

Claimed by vendors

CloudflareLogs only by default2026-10-25 · +3d AWSNo public claimNot named Microsoft AzureNo public claimNot named Google CloudNo public claimNot named FastlyRule published2026-10-26 · +4d F5No public claimNot named AkamaiNo public sourceNo public changelog OWASP CRSNo public claimNot named

Ask Vigil

AI · answers from this page

Ask about CVE-2026-111497: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Severity, decoded

CVSS 4.0

9.2Critical

Critical · 9.2 / 10

Exploitable over the network under specific conditions, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability.

Over the internetNo login neededNo user actionWorks reliablyFull compromise

How the score is built11 metrics

Attack vectorAn attacker can reach it over the internet; no access to your network needed.
Network
Attack complexityNo built-in defences have to be bypassed; the attack works reliably.
Low
Attack requirementsThe attack only works under specific conditions, such as a race or a particular setup.
Present
Privileges requiredNo account or login is needed.
None
User interactionNo one has to click or open anything; the attack works on its own.
None
Confidentiality impact (vulnerable system)An attacker can read all data the affected component holds, or the most sensitive parts of it.
High
Integrity impact (vulnerable system)An attacker can change any data or files the affected component protects.
High
Availability impact (vulnerable system)An attacker can take the component down completely or keep it from serving anyone.
High
Confidentiality impact (other systems)Other systems' data is not exposed.
None
Integrity impact (other systems)Other systems' data cannot be changed.
None
Availability impact (other systems)Other systems keep working normally.
None

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA's assessmentSSVC, from the CVE record

ExploitationActive

Attackers are exploiting this in the wild.

AutomatableNo

At least one step needs hands-on work, which slows mass attacks.

Technical impactTotal

A successful attack gives full control over the affected software or all of its data.

Public exploits

3 found

0 Metasploit0 Exploit-DB0 Scanner template3 GitHub PoCs

No exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.

Links are to third-party code: never run it outside an isolated lab.

Timeline

2026-10-22
CVE published
CVE List
2026-10-25
Cloudflare ships a rule
Brotli - Request Content-Encoding - CVE:CVE-2026-111497
2026-10-26
Fastly ships a rule
Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell)
2026-10-27
Added to CISA KEV
Confirmed exploitation in the wild
2026-10-27
First social mention we saw
2026-11-02
First public exploit repository
ChriSec7/CVE-2026-111497-POC

Vendor statements

Quoted

CloudflareWAF Managed Rules2 quotesLogs only by default

First rule 2026-10-25, 3 days after the CVE was published.

2026-10-25New rule…ca706f3cDefault: LogSource

Brotli - Request Content-Encoding - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.

2026-10-25New rule…402fe5bbDefault: LogSource

Next.js - Image Optimizer Path - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.

AWSAWS WAF Managed RulesNo public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.

Microsoft AzureFront Door and Application Gateway WAF (DRS)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.

Google CloudCloud Armor preconfigured WAF rulesNo public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.

FastlyNext-Gen WAF virtual patches1 quoteRule published

First rule 2026-10-26, 4 days after the CVE was published.

2026-10-26New ruleSource

Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell). A buffer overflow vulnerability that can lead to remote code execution has been found in the Google Brotli decompression library (versions 1.0.3 through 1.2.0), used by Node.js, Python and other software, and has been assigned CVE-2026-111497. Fastly has created a virtual patch for it that is now available within your account. If you’ve previously enabled the Automatic CVE Virtual Patching setting , we’ve already enabled this vir…

F5Attack signatures (Distributed Cloud WAF)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Each signature lists the CVEs it references, with its id and date. F5 does not state a default action; signatures enforce once staging ends in your policy.

AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.

Is your site covered?

We find your CDN or WAF in public DNS and match it to this CVE. Nothing is sent to your site.

Vigilbase Shield

Cloudflare has a rule for this CVE. Shield puts it in front of your site, managed for you.

Managed Cloudflare WAF and DDoS protection on a monthly plan, run by our team.

See Shield plans Under attack right now? Get help now

Our lab test

Measured

Nothing to replay yet

Exploit code exists (3 items below), but we only replay declarative request templates, never third-party exploit code. Flaws in kernels, libraries or VPN clients can't be reached through a WAF at all.

We'll test it within a minute of a template appearing in nuclei-templates.

Watching for templates · checked just now4,450 CVEs tested

Exposure

Estimates

No website count: Brotli isn't web software we can count from the outside.

82.6%chance of exploitation in 30 days

FIRST EPSS, updated daily. Top 0.3% of all CVEs by this score.

For agents

$ curl https://cve.vigilbase.com/api/v1/cves/CVE-2026-111497

MCP server Markdown CVE.org NVD