A security vulnerability identified as CVE-2026-111497 affects the Google Brotli Decoder used in Red Hat Enterprise Linux 9.2. This vulnerability involves an out-of-bounds write, which can lead to potential memory corruption. The issue has been addressed in an update provided by Red Hat. The vulnerability is rated as high severity and is known to be exploited in the wild. Additional bug fixes and enhancements related to Brotli were also included in the update.

Red Hat Security Advisory: brotli security, bug fix, and enhancement update

A security vulnerability (CVE-2026-111497) in the Google Brotli decoder used in Red Hat Enterprise Linux 8.4 can cause an out-of-bounds write. Brotli is a lossless compression algorithm used for data compression. This flaw has been rated as having a high severity impact and is known to be exploited in the wild. Red Hat has issued a security advisory and released updates to address this issue for affected versions of Red Hat Enterprise Linux 8.4.

Red Hat Security Advisory: brotli security update

An out-of-bounds write vulnerability (CVE-2026-111497) exists in the Google Brotli decoder, a lossless compression algorithm used in Red Hat Enterprise Linux 8.8 variants. This flaw has been rated as having a high security impact and is known to be exploited in the wild. Red Hat has issued a security advisory and released updates to address this issue.

A security vulnerability (CVE-2026-111497) in the Google Brotli decoder used in Red Hat Enterprise Linux 9.4 has been identified as an out-of-bounds write. This flaw could potentially allow attackers to write data outside the intended buffer boundaries, leading to possible memory corruption. Red Hat has issued an important security advisory with a patch to address this issue. The update also fixes a related bug affecting previous CVE-2025-66471 mitigations. The vulnerability is rated as high severity and is known to be exploited in the wild. The affected products include various architectures of Red Hat Enterprise Linux 9.4 and related AppStream and BaseOS components. Users are advised to apply the provided update to remediate the vulnerability.

A security vulnerability (CVE-2026-111497) in the Google Brotli decoder used in Red Hat Enterprise Linux 8.6 causes an out-of-bounds write. Brotli is a lossless compression algorithm used for data compression. This flaw has been rated as having a high security impact and is known to be exploited in the wild. Red Hat has issued an important security update to address this issue.

A security vulnerability (CVE-2026-111497) in the Google Brotli decoder used in Red Hat Enterprise Linux 10.0 Extended Update Support allows an out-of-bounds write. This flaw is addressed in an update provided by Red Hat. The vulnerability is rated as high severity and is known to be exploited in the wild. The update also fixes an unrelated bug affecting a previous CVE fix. Red Hat has released patched packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64.

scrapy

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. The vulnerability is rated critical with a CVSS 4.0 score of 9.2.

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package (CVE-2026-111497)

CVE-2026-111497, known as Brotli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli C decoder library. It affects many widely used software projects that decompress Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and PHP for Windows. The flaw can be triggered by decompressing crafted Brotli data, potentially leading to process crashes, memory leaks, or remote code execution. The vulnerability has a high CVSSv4.0 score of 9.2 assigned by Google. Patches have been released for the Brotli library and major runtimes, but some projects had not shipped fixed releases as of late October 2026. Applications bundling their own Brotli decoder require individual updates.

Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

Multiple security issues have been fixed in the python313-Brotli-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed. The details of these issues are not specified in the provided data.

python313-Brotli-1.2.1-1.1 on GA media

A security update has been issued for the Brotli compression library, providing a functional equivalent of the Red Hat advisory RHSA-2026:90501. The update addresses a vulnerability identified as CVE-2026-111497. No specific affected versions or detailed technical information are provided in the available data.

A security update for the Brotli compression library has been released by SUSE Product Security Team, providing a functional equivalent of the Red Hat advisory RHSA-2026:90495. The update addresses a vulnerability identified as CVE-2026-111497. No specific affected versions or technical details are provided in the available data.

A security update for the Brotli compression library has been released by SUSE Product Security Team. This update is functionally equivalent to the Red Hat advisory RHSA-2026:90449. No specific details about the vulnerability or affected versions are provided in the available data.

brotli

A vulnerability in Brotli was discovered where it incorrectly handled certain compressed streams. This flaw could allow a remote attacker to cause a denial of service or execute arbitrary code by providing specially crafted input. The issue affects multiple Ubuntu package versions and has been addressed in updated releases. Users are advised to update to the fixed package versions to mitigate the risk.

brotli vulnerability (CVE-2026-111497)

locust

A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. Additionally, the vulnerability affects the locust product in versions >=2.2.1 <2.18.4 and >=2.23.1 <2.47.0_1, with fixes available in 2.18.4 and 2.47.0_1.

pdfly

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

flexget

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. The vulnerability is rated critical with a CVSS 9.2 score.

gallery-dl

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2.

fonttools

CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Fixed versions are available, and users should update to versions 1.0.10, 1.1.1, 1.2.1 or later.

weasyprint

A buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The vulnerability affects all platforms and requires updating to fixed versions 1.0.10, 1.1.1, or 1.2.1. The CVSS 4.0 score is 9.2, indicating critical severity.

Search: CVE-2026-111497