CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Original title: AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
Canada’s Cyber Centre warned on October 28, 2026 about CVE-2026-111497, an unauthenticated out-of-bounds write in the Google Brotli decoder known as Broccoli2Shell. Specially crafted compressed data can corrupt memory, disclose information, crash a process, or execute arbitrary code. Software that may bundle vulnerable Brotli includes Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27, 2026.
Unconfirmed: One sentence tells BeyondTrust Remote Support users to upgrade, but the version table covers only Brotli.
- Fixed Brotli releases named in the alert are 1.0.10, 1.1.1, and 1.2.1.
- Listed affected ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.
- Until patched, the alert says to stop processing untrusted Brotli content.
Impact: Unauthenticated memory corruption or arbitrary code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 prior to 1.0.10; 1.1.0 prior to 1.1.1; 1.2.0 prior to 1.2.1 | 1.0.10, 1.1.1, 1.2.1 |
- 1.Upgrade Brotli to 1.0.10, 1.1.1, or 1.2.1 on the affected release line.
- 2.Prioritize internet-facing apps and dependencies that bundle vulnerable Brotli.
- 3.Until updated, block untrusted Brotli-compressed input to affected applications.
- CVEs
- CVE-2026-111497
- Vendors
- Organizations
- Canadian Centre for Cyber SecurityCISA
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cyber.gc.ca
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.