brotli

CVE-2026-111497 is a critical out-of-bounds write vulnerability in Google's Brotli decompression library that allows specially crafted compressed data to corrupt application memory and potentially enable remote code execution. It affects Brotli versions 1.0.3 through 1.2.0 and multiple platforms including Node.js, Bun, Python, and .NET frameworks. Exploitation attempts were observed shortly after patches were released, with proof-of-concept code demonstrating remote code execution via malicious HTTP requests and responses. The vulnerability can be triggered through various vectors such as HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also impacted, broadening the attack surface. CISA added this vulnerability to its KEV catalog on October 27, 2026.

Node2Shell (CVE-2026-111497): Brotli RCE Exploited

python-brotlicffi

A critical buffer overflow vulnerability exists in the Brotli decoder used by python-brotlicffi versions prior to 1.1.0.0-2.oe2403sp4. This flaw allows a remote unauthenticated attacker to corrupt memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Users should update to fixed versions 1.1.0.0-2.oe2403sp4 or later to mitigate the risk.

python-brotlicffi security update (CVE-2026-111497)

A buffer overflow vulnerability exists in the Brotli decoder component of the python-brotlicffi library, affecting Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The vulnerability is critical with a CVSS score of 9.2. Fixed versions have been released, and users are advised to update to version 1.1.0.0-2.oe2403sp3 or later.

A buffer overflow vulnerability exists in the Brotli decoder used by python-brotlicffi, affecting Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially disclosing sensitive information, causing denial of service, or executing arbitrary code. The issue is fixed in version 1.1.0.0-2.oe2403sp1 and later.

A critical buffer overflow vulnerability exists in the Brotli decoder versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The issue affects all platforms using these versions of the Brotli library. Fixed versions 1.1.1-1.oe2403sp3 and later are available and should be applied promptly.

brotli security update (CVE-2026-111497)

A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. The issue is fixed in version 1.1.1-1.oe2403sp1 and later. Users should update affected Brotli libraries or binaries to a patched version to mitigate the risk.

A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Fixed versions 1.0.10, 1.1.1, and 1.2.1 address this issue. Users should update affected Brotli libraries or binaries to these versions to mitigate the risk.

A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The issue is fixed in versions 1.1.1-1.oe2403sp4 and later. Users should update affected Brotli libraries or binaries to these fixed versions to mitigate the risk.

tubeup

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1 to mitigate this issue.

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package (CVE-2026-111497)

powershell

A buffer overflow vulnerability exists in the Brotli decoder used by Google Brotli versions 1.0.3 through 1.2.0, affecting PowerShell versions 7.4.0 through 7.4.21, 7.5.0 through 7.5.12, and 7.6.0 through 7.6.8. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Fixed versions are 7.4.22, 7.5.13, and 7.6.9.

Powershell: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

dotnet

A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Fixed versions are available and users should update to versions 1.0.10, 1.1.1, or 1.2.1 to remediate this issue.

Dotnet: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Fixed versions include 1.0.10, 1.1.1, and 1.2.1.

Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

CVE-2026-111497 is a vulnerability in the native Brotli decompression library that could allow remote code execution or memory disclosure. AWS has acknowledged this issue affecting multiple services including AWS Lambda, Amplify, App Runner, CloudWatch Synthetics, CodeBuild, Elastic Beanstalk, and Elemental MediaLive. Some of these services require customer action to address the vulnerability. AWS is actively addressing the issue as detailed in their security bulletin published on October 28, 2026.

CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

CVE-2026-111497, known as Node2Shell or HTTP2Shell, is an out-of-bounds write vulnerability in Google's Brotli decoder affecting multiple runtimes including Node.js, Bun, Python, .NET, Envoy Proxy, and Java brotli4j. The flaw can be triggered by decompressing attacker-controlled Brotli data, potentially causing crashes, memory disclosure, or remote code execution. Exploitation has been observed shortly after disclosure, with both reconnaissance and active exploitation attempts reported. Organizations are advised to patch vulnerable components immediately and monitor for suspicious activity.

Node2Shell / HTTP2Shell Vulnerability May Allow RCE

A security vulnerability (CVE-2026-111497) exists in the Google Brotli decoder used in Red Hat Hardened Images RPMs, including dotnet8.0 packages. The flaw is an out-of-bounds write triggered by a crafted Brotli-compressed stream, potentially leading to memory disclosure, denial of service, or arbitrary code execution. Exploitation requires decompressing attacker-controlled Brotli data with a malformed stream. Red Hat rates the issue as Important with high attack complexity due to platform hardenings like ASLR and SELinux. Updates are available for affected packages.

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Multiple security issues were addressed in the ghostscript-10.08.0-3.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the Ghostscript software distributed by SUSE. No specific details about the nature or impact of the vulnerabilities are provided.

ghostscript-10.08.0-3.1 on GA media

USN-8956-1 fixed a vulnerability in Brotli. This update provides the
corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS.

Original advisory details:

 It was discovered that Brotli incorrectly handled certain compressed
 streams. A remote attacker could possibly use this issue to cause a
 denial of service or execute arbitrary code.

brotli vulnerability (CVE-2026-111497)

A security update for the Brotli compression library addresses an out-of-bounds write vulnerability (CVE-2026-111497) in the Google Brotli decoder. This flaw could potentially lead to memory corruption. The update also fixes a bug related to Python parameter naming that affected previous fixes for another vulnerability (CVE-2025-66471). The issue affects Red Hat Enterprise Linux 9.6 Extended Update Support and related variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has released patches to remediate this vulnerability.

Red Hat Security Advisory: brotli security, bug fix, and enhancement update

A security vulnerability identified as CVE-2026-111497 affects the Google Brotli Decoder used in Red Hat Enterprise Linux 9.2. This vulnerability involves an out-of-bounds write, which can lead to potential memory corruption. The issue has been addressed in an update provided by Red Hat. The vulnerability is rated as high severity and is known to be exploited in the wild. Additional bug fixes and enhancements related to Brotli were also included in the update.

A security vulnerability (CVE-2026-111497) in the Google Brotli decoder used in Red Hat Enterprise Linux 8.4 can cause an out-of-bounds write. Brotli is a lossless compression algorithm used for data compression. This flaw has been rated as having a high severity impact and is known to be exploited in the wild. Red Hat has issued a security advisory and released updates to address this issue for affected versions of Red Hat Enterprise Linux 8.4.

Search: CVE-2026-111497