# CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

- Exploited (CISA KEV): yes, added 2026-10-27
- Published: 2026-10-22
- CVSS: 9.2 CRITICAL (v4.0)
- EPSS: 82.6% (100th percentile)
- CWE: CWE-787, CWE-252

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Logs only by default | 2026-10-25 | 3 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Rule published | 2026-10-26 | 4 |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-10-25 · new · rule 8f252673b69d47afb21f88acca706f3c · default Log
  > Brotli - Request Content-Encoding - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/
- 2026-10-25 · new · rule 33dc63d3171649ed8f267455402fe5bb · default Log
  > Next.js - Image Optimizer Path - CVE:CVE-2026-111497. Previous action: N/A. New action: Log. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/

### Fastly

- 2026-10-26 · new
  > Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell). A buffer overflow vulnerability that can lead to remote code execution has been found in the Google Brotli decompression library (versions 1.0.3 through 1.2.0), used by Node.js, Python and other software, and has been assigned CVE-2026-111497. Fastly has created a virtual patch for it that is now available within your account. If you’ve previously enabled the Automatic CVE Virtual Patching setting , we’ve already enabled this vir…
  Source: https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-cve-2026-111497/

## Social

10 posts seen since 2026-10-27.

- Exploit repository (unvetted): https://github.com/fortbridge/cve-2026-111497-wordpress-pingback-brotli
- Exploit repository (unvetted): https://github.com/EQSTLab/CVE-2026-111497
- Exploit repository (unvetted): https://github.com/ChriSec7/CVE-2026-111497-POC
- bluesky 2026-11-02: S09E04b - The October 2026 Brotli Security Update: Who It Affects
 
 A short bonus episode about Common Vulnerabilities and Exposures (CVE) entry CVE-2026-111497. This is a flaw in the Brotli decompression library that .NET uses. Microsoft released a fix for .NET 8, .NET 9 and .… (https://bsky.app/profile/gaprogman.com/post/3mzed6v3tcb2j)
- x 2026-11-02: 🚨 【続報】Brotliの脆弱性がNeat会議端末にも影響！修正配信まで暫定対策を 🐟 危険度：8/10（独自評価） 📅 発表日：2026年11月2日  ━━━━━━━━━━━━ 🔍 何が起きた？ 既報のBrotli脆弱性（CVE-2026-111497）について、Neatが会議端末への影響、修正予定、暫定対策を公表しました。 (https://x.com/SecureAnago_JP/status/2117375807169691904)
- x 2026-11-02: boh starred fortbridge/cve-2026-111497-wordpress-pingback-brotli on Github https://t.co/ojWDoBX1xk (https://x.com/0xbfho/status/2117368538138563037)
- hn 2026-11-02: I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still "under consideration" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old ser… (https://news.ycombinator.com/item?id=50342016)
- hn 2026-10-31: It's not a good look. I pulled in from -proposed this time. Ubuntu was slow on the brotli / CVE-2026-111497 updates as well. (https://news.ycombinator.com/item?id=50321108)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-111497 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-111497