# CVE-2026-111497: Google Brotli Unchecked Return Value - **Severity:** Critical 9.2 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) - **Exploited in the wild:** Yes, since 27 Oct 2026 (CISA KEV) - **Fix available:** Yes - **Published:** 22 Oct 2026 - **Updated:** 28 Oct 2026 - **Also known as:** ALPINE-CVE-2026-111497, ALSA-2026:90449, ALSA-2026:90495, ALSA-2026:90501, AZL-110384, AZL-111005, AZL-111041, AZL-111518, BELL-CVE-2026-111497, BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, CLSA-2026-1792754583, CLSA-2026-1792755607, CLSA-2026-1792824525, CLSA-2026-1792824700, CLSA-2026-1792824879, CLSA-2026-1792827041, CLSA-2026-1792827285, CLSA-2026-1792827522, CLSA-2026-1792832424, CLSA-2026-1792865919, CLSA-2026-1792867484, DEBIAN-CVE-2026-111497, ECHO-1099-6733-474b, GHSA-9v8h-qqgm-4m35, OESA-2026-4539, OESA-2026-4540, OESA-2026-4541, OESA-2026-4542, OESA-2026-4601, OESA-2026-4602, OESA-2026-4603, PYSEC-2026-4322, PYSEC-2026-4323, RLSA-2026:90449, RLSA-2026:90495, RLSA-2026:90501, ROOT-APP-PYPI-GHSA-9v8h-qqgm-4m35, ROOT-OS-ALPINE-320-CVE-2026-111497, ROOT-OS-DEBIAN-11-CVE-2026-111497, ROOT-OS-UBUNTU-2004-CVE-2026-111497, ROOT-OS-UBUNTU-2504-CVE-2026-111497, ROOT-OS-UBUNTU-2510-CVE-2026-111497, UBUNTU-CVE-2026-111497, USN-8956-1, USN-8956-2, openSUSE-SU-2026:12232-1, openSUSE-SU-2026:12305-1, openSUSE-SU-2026:12322-1 ## What is CVE-2026-111497? CVE-2026-111497 is a critical vulnerability in Debian Debian Linux, published on 22 Oct 2026. ### Official description A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Weakness: CWE-787 (Out-of-bounds Write), CWE-252 (Unchecked Return Value) ## Which versions are affected by CVE-2026-111497? 12 open source packages ship an affected version, including brotli, dotnet and dotnet-sdk. It affects 16 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `brotli` | Bitnami | From 1.0.3 | 1.0.10, 1.1.1, 1.2.1 | | `brotli` | PyPI | All versions | 1.2.1 | | `brotli` | PyPI | From 1.0.3 | 1.2.1 | | `brotli` | PyPI | From 1.0.3 | 1.2.1 | | `dotnet` | Bitnami | From 8.0.0 | 8.0.33, 9.0.22, 10.0.14 | | `dotnet-sdk` | Bitnami | From 8.0.0 | 8.0.33, 9.0.22, 10.0.14 | | `node` | Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 | | `node-min` | Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 | | `powershell` | Bitnami | From 7.4.0 | 7.4.22, 7.5.13, 7.6.9 | | `brotlicffi` | PyPI | All versions | 1.2.1.0 | | `brotlicffi` | PyPI | From 1.0.3 | 1.2.1.0 | | `brotlicffi` | PyPI | From 1.0.3 | 1.2.1.0 | | `brotli` | AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 | | `brotli-devel` | AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 | | `libbrotli` | AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 | | `python3-brotli` | AlmaLinux:10 | All versions | 1.1.0-8.el10_2.1 | | `brotli` | AlmaLinux:8 | All versions | 1.0.6-5.el8_10 | | `brotli-devel` | AlmaLinux:8 | All versions | 1.0.6-5.el8_10 | | `python3-brotli` | AlmaLinux:8 | All versions | 1.0.6-5.el8_10 | | `brotli` | AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 | | `brotli-devel` | AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 | | `libbrotli` | AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 | | `python3-brotli` | AlmaLinux:9 | All versions | 1.0.9-10.el9_8.1 | | `brotli` | Rocky Linux:10 | All versions | 0:1.1.0-8.el10_2.1 | | `brotli` | Rocky Linux:8 | All versions | 0:1.0.6-5.el8_10 | | `brotli` | Rocky Linux:9 | All versions | 0:1.0.9-10.el9_8.1 | | `brotli` | openSUSE:Tumbleweed | All versions | 1.2.1-1.1 | | `ghostscript` | openSUSE:Tumbleweed | All versions | 10.08.0-3.1 | | `python-Brotli` | openSUSE:Tumbleweed | All versions | 1.2.1-1.1 | Products: 7-Zip P7zip, Andybalholm Brotli, Anthropic Bun, Apache Arrow, Clickhouse Clickhouse, Debian Debian Linux, Duckdb Duckdb, Envoyproxy Envoy, Google Brotli, Google Woff2, Istio Istio, Mcmilk 7-Zip-Zstd, Microsoft .Net, Nodejs Node.js, Python-Hyper Brotlicffi, Tianocore Edk2. ## How do I fix CVE-2026-111497? Upgrade brotli to a fixed version for your release line: 1.0.10, 1.1.1 or 1.2.1. US federal agencies must fix it by 10 Nov 2026. ## Is CVE-2026-111497 being exploited? Yes. Attackers have exploited CVE-2026-111497 in the wild since at least 27 Oct 2026. Public exploit code: - High fidelity detection mechanism for node2shell (CVE-2026-111497) (github_poc): https://github.com/assetnote/node2shell-scanner - Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness (github_poc): https://github.com/dimasma0305/CVE-2026-111497-POC - Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497. (github_poc): https://github.com/trailofbits/brotli-checker - CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2) (github_poc): https://github.com/syrex1013/CVE-2026-111497-node2shell - CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress (github_poc): https://github.com/caveeroo/cve-2026-111497-wordpress-poc - Nodejs漏洞 CVE-2026-111497 POC (github_poc): https://github.com/CaterMaoZi/CVE-2026-111497-POC ## Other vulnerabilities in Debian Debian Linux - [CVE-2022-47069](https://insights.sbomify.com/CVE-2022-47069/): Memory corruption in n/a (high 7.8) - [CVE-2016-9296](https://insights.sbomify.com/CVE-2016-9296/): Null dereference in n/a (high 7.5) - [CVE-2015-1038](https://insights.sbomify.com/CVE-2015-1038/): Path traversal in n/a (medium 5.8) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-111497 and fix it if it is affected. What it is: CVE-2026-111497 is a critical vulnerability in Debian Debian Linux, published on 22 Oct 2026. Exploitation: Yes. Attackers have exploited CVE-2026-111497 in the wild since at least 27 Oct 2026. Affected packages and fixed versions: - brotli (Bitnami): affected from 1.0.3; fixed in 1.0.10, 1.1.1, 1.2.1 - brotli (PyPI): affected all versions; fixed in 1.2.1 - brotli (PyPI): affected from 1.0.3; fixed in 1.2.1 - brotli (PyPI): affected from 1.0.3; fixed in 1.2.1 - dotnet (Bitnami): affected from 8.0.0; fixed in 8.0.33, 9.0.22, 10.0.14 - dotnet-sdk (Bitnami): affected from 8.0.0; fixed in 8.0.33, 9.0.22, 10.0.14 - node (Bitnami): affected all versions; fixed in 22.23.4, 24.22.1, 26.12.1 - node-min (Bitnami): affected all versions; fixed in 22.23.4, 24.22.1, 26.12.1 - powershell (Bitnami): affected from 7.4.0; fixed in 7.4.22, 7.5.13, 7.6.9 - brotlicffi (PyPI): affected all versions; fixed in 1.2.1.0 - brotlicffi (PyPI): affected from 1.0.3; fixed in 1.2.1.0 - brotlicffi (PyPI): affected from 1.0.3; fixed in 1.2.1.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-111497/ (Markdown: https://insights.sbomify.com/CVE-2026-111497/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-111497 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497 - OSV: https://osv.dev/vulnerability/CVE-2026-111497 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-111497/ Summaries are generated and may contain mistakes; the official description above is the record.