{"answers":{"affected":"12 open source packages ship an affected version, including brotli, dotnet and dotnet-sdk. It affects 16 products.","exploited":"Yes. Attackers have exploited CVE-2026-111497 in the wild since at least 27 Oct 2026.","fix":"Upgrade brotli to a fixed version for your release line: 1.0.10, 1.1.1 or 1.2.1. US federal agencies must fix it by 10 Nov 2026.","what":"CVE-2026-111497 is a critical vulnerability in Debian Debian Linux, published on 22 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-111497 and fix it if it is affected.\n\nWhat it is: CVE-2026-111497 is a critical vulnerability in Debian Debian Linux, published on 22 Oct 2026. \nExploitation: Yes. Attackers have exploited CVE-2026-111497 in the wild since at least 27 Oct 2026.\n\nAffected packages and fixed versions:\n- brotli (Bitnami): affected from 1.0.3; fixed in 1.0.10, 1.1.1, 1.2.1\n- brotli (PyPI): affected all versions; fixed in 1.2.1\n- brotli (PyPI): affected from 1.0.3; fixed in 1.2.1\n- brotli (PyPI): affected from 1.0.3; fixed in 1.2.1\n- dotnet (Bitnami): affected from 8.0.0; fixed in 8.0.33, 9.0.22, 10.0.14\n- dotnet-sdk (Bitnami): affected from 8.0.0; fixed in 8.0.33, 9.0.22, 10.0.14\n- node (Bitnami): affected all versions; fixed in 22.23.4, 24.22.1, 26.12.1\n- node-min (Bitnami): affected all versions; fixed in 22.23.4, 24.22.1, 26.12.1\n- powershell (Bitnami): affected from 7.4.0; fixed in 7.4.22, 7.5.13, 7.6.9\n- brotlicffi (PyPI): affected all versions; fixed in 1.2.1.0\n- brotlicffi (PyPI): affected from 1.0.3; fixed in 1.2.1.0\n- brotlicffi (PyPI): affected from 1.0.3; fixed in 1.2.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-111497/ (Markdown: https://insights.sbomify.com/CVE-2026-111497/index.md)","id":"CVE-2026-111497","markdown":"https://insights.sbomify.com/CVE-2026-111497/index.md","name":"CVE-2026-111497","record":{"aliases":["ALPINE-CVE-2026-111497","ALSA-2026:90449","ALSA-2026:90495","ALSA-2026:90501","AZL-110384","AZL-111005","AZL-111041","AZL-111518","BELL-CVE-2026-111497","BIT-brotli-2026-111497","BIT-dotnet-2026-111497","BIT-dotnet-sdk-2026-111497","BIT-node-2026-111497","BIT-node-min-2026-111497","BIT-powershell-2026-111497","CLSA-2026-1792754583","CLSA-2026-1792755607","CLSA-2026-1792824525","CLSA-2026-1792824700","CLSA-2026-1792824879","CLSA-2026-1792827041","CLSA-2026-1792827285","CLSA-2026-1792827522","CLSA-2026-1792832424","CLSA-2026-1792865919","CLSA-2026-1792867484","DEBIAN-CVE-2026-111497","ECHO-1099-6733-474b","GHSA-9v8h-qqgm-4m35","OESA-2026-4539","OESA-2026-4540","OESA-2026-4541","OESA-2026-4542","OESA-2026-4601","OESA-2026-4602","OESA-2026-4603","PYSEC-2026-4322","PYSEC-2026-4323","RLSA-2026:90449","RLSA-2026:90495","RLSA-2026:90501","ROOT-APP-PYPI-GHSA-9v8h-qqgm-4m35","ROOT-OS-ALPINE-320-CVE-2026-111497","ROOT-OS-DEBIAN-11-CVE-2026-111497","ROOT-OS-UBUNTU-2004-CVE-2026-111497","ROOT-OS-UBUNTU-2504-CVE-2026-111497","ROOT-OS-UBUNTU-2510-CVE-2026-111497","UBUNTU-CVE-2026-111497","USN-8956-1","USN-8956-2","openSUSE-SU-2026:12232-1","openSUSE-SU-2026:12305-1","openSUSE-SU-2026:12322-1"],"analysis":null,"analysis_generated_by":null,"assigner":"Google","cpe":[{"product":"p7zip","vendor":"7-zip"},{"product":"brotli","vendor":"andybalholm"},{"product":"bun","vendor":"anthropic"},{"product":"arrow","vendor":"apache"},{"product":"clickhouse","vendor":"clickhouse"},{"product":"debian_linux","vendor":"debian"},{"product":"duckdb","vendor":"duckdb"},{"product":"envoy","vendor":"envoyproxy"},{"product":"brotli","vendor":"google"},{"product":"woff2","vendor":"google"},{"product":"istio","vendor":"istio"},{"product":"7-zip-zstd","vendor":"mcmilk"},{"product":".net","vendor":"microsoft"},{"product":"node.js","vendor":"nodejs"},{"product":"brotlicffi","vendor":"python-hyper"},{"product":"edk2","vendor":"tianocore"}],"cvss":{"score":9.2,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-252","name":"Unchecked Return Value"}],"description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","ecosystems":["AlmaLinux:10","AlmaLinux:8","AlmaLinux:9","Bitnami","PyPI","Rocky Linux:10","Rocky Linux:8","Rocky Linux:9","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":"2026-10-21","github_poc":74,"max_poc_stars":85,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-25T04:23:54Z","kind":"github_poc","ref":"https://github.com/assetnote/node2shell-scanner","stars":85,"title":"High fidelity detection mechanism for node2shell (CVE-2026-111497)"},{"date":"2026-10-22T04:08:28Z","kind":"github_poc","ref":"https://github.com/dimasma0305/CVE-2026-111497-POC","stars":71,"title":"Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness"},{"date":"2026-10-23T16:32:12Z","kind":"github_poc","ref":"https://github.com/trailofbits/brotli-checker","stars":65,"title":"Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497."},{"date":"2026-10-24T23:03:18Z","kind":"github_poc","ref":"https://github.com/syrex1013/CVE-2026-111497-node2shell","stars":48,"title":"CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)"},{"date":"2026-10-28T22:42:33Z","kind":"github_poc","ref":"https://github.com/caveeroo/cve-2026-111497-wordpress-poc","stars":24,"title":"CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress"},{"date":"2026-10-21T15:47:21Z","kind":"github_poc","ref":"https://github.com/CaterMaoZi/CVE-2026-111497-POC","stars":17,"title":"Nodejs漏洞 CVE-2026-111497 POC"},{"date":"2026-10-23T10:53:00Z","kind":"github_poc","ref":"https://github.com/ZeroHackOrg/node2shell-poc","stars":8,"title":"ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab \u0026 PoC Framework"},{"date":"2026-10-22T08:52:11Z","kind":"github_poc","ref":"https://github.com/hypnguyen1209/CVE-2026-111497","stars":7,"title":"Node.js Brotli Decoder OOB Write to RCE"}],"tier":"exploited"},"has_fix":true,"headline":"Google Brotli Unchecked Return Value","id":"CVE-2026-111497","indexable":true,"kev":{"dateAdded":"2026-10-27","dueDate":"2026-11-10","knownRansomwareCampaignUse":"Unknown","product":"Brotli","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","vendorProject":"Google","vulnerabilityName":"Google Brotli Unchecked Return Value Vulnerability"},"kind":"cve","links":{"ecosystem":"Bitnami","product":"debian:debian_linux","products":["debian:debian_linux","envoyproxy:envoy","microsoft:.net","nodejs:node.js"],"type":null,"year":"2026"},"n_packages":29,"n_references":2,"next":{"headline":"A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers.","id":"CVE-2026-111548"},"packages":[{"ecosystem":"Bitnami","fixed":["1.0.10","1.1.1","1.2.1"],"introduced":["1.0.3","1.1.0","1.2.0"],"last_affected":[],"package":"brotli","purl":"pkg:bitnami/brotli","source":"BIT-brotli-2026-111497"},{"ecosystem":"Bitnami","fixed":["8.0.33","9.0.22","10.0.14"],"introduced":["8.0.0","9.0.0","10.0.0"],"last_affected":[],"package":"dotnet","purl":"pkg:bitnami/dotnet","source":"BIT-dotnet-2026-111497"},{"ecosystem":"Bitnami","fixed":["8.0.33","9.0.22","10.0.14"],"introduced":["8.0.0","9.0.0","10.0.0"],"last_affected":[],"package":"dotnet-sdk","purl":"pkg:bitnami/dotnet-sdk","source":"BIT-dotnet-sdk-2026-111497"},{"ecosystem":"Bitnami","fixed":["22.23.4","24.22.1","26.12.1"],"introduced":["0","23.0.0","26.0.0"],"last_affected":[],"package":"node","purl":"pkg:bitnami/node","source":"BIT-node-2026-111497"},{"ecosystem":"Bitnami","fixed":["22.23.4","24.22.1","26.12.1"],"introduced":["0","23.0.0","26.0.0"],"last_affected":[],"package":"node-min","purl":"pkg:bitnami/node-min","source":"BIT-node-min-2026-111497"},{"ecosystem":"Bitnami","fixed":["7.4.22","7.5.13","7.6.9"],"introduced":["7.4.0","7.5.0","7.6.0"],"last_affected":[],"package":"powershell","purl":"pkg:bitnami/powershell","source":"BIT-powershell-2026-111497"},{"ecosystem":"PyPI","fixed":["1.2.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:pypi/brotli","source":"PYSEC-2026-4322"},{"ecosystem":"PyPI","fixed":["1.2.1"],"introduced":["1.0.3"],"last_affected":[],"package":"brotli","purl":null,"source":"GHSA-9v8h-qqgm-4m35"},{"ecosystem":"PyPI","fixed":["1.2.1"],"introduced":["1.0.3"],"last_affected":[],"package":"brotli","purl":"pkg:pypi/brotli","source":"GHSA-9v8h-qqgm-4m35"},{"ecosystem":"PyPI","fixed":["1.2.1.0"],"introduced":["0"],"last_affected":[],"package":"brotlicffi","purl":"pkg:pypi/brotlicffi","source":"PYSEC-2026-4323"},{"ecosystem":"PyPI","fixed":["1.2.1.0"],"introduced":["1.0.3"],"last_affected":[],"package":"brotlicffi","purl":null,"source":"GHSA-9v8h-qqgm-4m35"},{"ecosystem":"PyPI","fixed":["1.2.1.0"],"introduced":["1.0.3"],"last_affected":[],"package":"brotlicffi","purl":"pkg:pypi/brotlicffi","source":"GHSA-9v8h-qqgm-4m35"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-8.el10_2.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:90449"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-8.el10_2.1"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:90449"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-8.el10_2.1"],"introduced":["0"],"last_affected":[],"package":"libbrotli","purl":"pkg:rpm/almalinux/libbrotli","source":"ALSA-2026:90449"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-8.el10_2.1"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:90449"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-5.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:90501"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-5.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:90501"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-5.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:90501"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-10.el9_8.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:90495"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-10.el9_8.1"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:90495"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-10.el9_8.1"],"introduced":["0"],"last_affected":[],"package":"libbrotli","purl":"pkg:rpm/almalinux/libbrotli","source":"ALSA-2026:90495"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-10.el9_8.1"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:90495"},{"ecosystem":"Rocky Linux:10","fixed":["0:1.1.0-8.el10_2.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/rocky-linux/brotli?distro=rocky-linux-10\u0026epoch=0","source":"RLSA-2026:90449"},{"ecosystem":"Rocky Linux:8","fixed":["0:1.0.6-5.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/rocky-linux/brotli?distro=rocky-linux-8\u0026epoch=0","source":"RLSA-2026:90501"},{"ecosystem":"Rocky Linux:9","fixed":["0:1.0.9-10.el9_8.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/rocky-linux/brotli?distro=rocky-linux-9\u0026epoch=0","source":"RLSA-2026:90495"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.2.1-1.1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/opensuse/brotli\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2026:12232-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["10.08.0-3.1"],"introduced":["0"],"last_affected":[],"package":"ghostscript","purl":"pkg:rpm/opensuse/ghostscript\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2026:12322-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.2.1-1.1"],"introduced":["0"],"last_affected":[],"package":"python-Brotli","purl":"pkg:rpm/opensuse/python-Brotli\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2026:12305-1"}],"prev":{"headline":"Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation","id":"CVE-2026-111496"},"products":["Brotli"],"published":"2026-10-22","related":[{"cvss_score":7.8,"headline":"Memory corruption in n/a","id":"CVE-2022-47069","kev_date_added":null,"published":"2023-08-22"},{"cvss_score":7.5,"headline":"Null dereference in n/a","id":"CVE-2016-9296","kev_date_added":null,"published":"2016-11-12"},{"cvss_score":5.8,"headline":"Path traversal in n/a","id":"CVE-2015-1038","kev_date_added":null,"published":"2015-01-21"}],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"BSD","name":"Rocky Linux","prefix":"RLSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Google"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-111497/"}