Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
86
Product
Apache Arrow
- Mentions · 7d4
- Mentions · 30d5
- All mentions5
- First seenOct 12, 2026
- Last mentioned3d ago
Timeline
5 articles · newest firstGoogle Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
76
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
74
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
68
Filter, reshape, and redact logs before export with Transformers
Cloudflare Logpush Transformers, now generally available, filter, redact, and reshape logs with SQL before export.
28
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
Appears with
- Brotliproduct · 4
- FFmpegproduct · 4
- .NETproduct · 4
- Googlevendor · 4
- Microsoftvendor · 3
- JFrogorganization · 3
- Node.jsproduct · 3
- ClickHouseproduct · 3
- Bunproduct · 2
- Istioproduct · 2
- Envoy Proxyproduct · 2
- Tenableorganization · 2
- Apachevendor · 1
- Aikido Securityorganization · 1
- libjxlproduct · 1
- Transformersproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.