CVE-2026-111497 Google Brotli Unchecked Return Value
- Exploited in the wild
- Since 27 Oct 2026
- Fix
- Available
What is CVE-2026-111497?
CVE-2026-111497 is a critical vulnerability in Debian Debian Linux, published on 22 Oct 2026.
Official description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Which versions are affected by CVE-2026-111497?
12 open source packages ship an affected version, including brotli, dotnet and dotnet-sdk. It affects 16 products.
| Package | Affected | Fixed in |
|---|---|---|
brotli Bitnami | From 1.0.3 | 1.0.10, 1.1.1, 1.2.1 |
brotli PyPI | All versions | 1.2.1 |
brotli PyPI | From 1.0.3 | 1.2.1 |
brotli PyPI | From 1.0.3 | 1.2.1 |
dotnet Bitnami | From 8.0.0 | 8.0.33, 9.0.22, 10.0.14 |
dotnet-sdk Bitnami | From 8.0.0 | 8.0.33, 9.0.22, 10.0.14 |
6 more packages
node Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
node-min Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
powershell Bitnami | From 7.4.0 | 7.4.22, 7.5.13, 7.6.9 |
brotlicffi PyPI | All versions | 1.2.1.0 |
brotlicffi PyPI | From 1.0.3 | 1.2.1.0 |
brotlicffi PyPI | From 1.0.3 | 1.2.1.0 |
Linux distribution packages (17)
brotli AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 |
brotli-devel AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 |
libbrotli AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 |
python3-brotli AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 |
brotli AlmaLinux:8 | All versions | 1.0.6-5.el8_10 |
brotli-devel AlmaLinux:8 | All versions | 1.0.6-5.el8_10 |
python3-brotli AlmaLinux:8 | All versions | 1.0.6-5.el8_10 |
brotli AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 |
brotli-devel AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 |
libbrotli AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 |
python3-brotli AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 |
brotli Rocky Linux:10 | All versions | 0:1.1.0-8.el10_2.1 |
brotli Rocky Linux:8 | All versions | 0:1.0.6-5.el8_10 |
brotli Rocky Linux:9 | All versions | 0:1.0.9-10.el9_8.1 |
brotli openSUSE:Tumbleweed | All versions | 1.2.1-1.1 |
ghostscript openSUSE:Tumbleweed | All versions | 10.08.0-3.1 |
python-Brotli openSUSE:Tumbleweed | All versions | 1.2.1-1.1 |
Products include 7-Zip P7zip, Andybalholm Brotli, Anthropic Bun, Apache Arrow, Clickhouse Clickhouse, Debian Debian Linux and 10 more.
How do I fix CVE-2026-111497?
Upgrade brotli to a fixed version for your release line: 1.0.10, 1.1.1 or 1.2.1. US federal agencies must fix it by 10 Nov 2026.
Is CVE-2026-111497 being exploited?
Yes. Attackers have exploited CVE-2026-111497 in the wild since at least 27 Oct 2026.
Public exploit code: 74 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2026-111497, ALSA-2026:90449, ALSA-2026:90495, ALSA-2026:90501, AZL-110384, AZL-111005 and 47 more.