Brotli 1.2.1 published for CVE-2026-111497
Original title: Re: Brotli CVE-2026-111497
An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.
Alan Coopersmith replied on oss-security that patchtheplanet.org also reports Brotli CVE-2026-111497. He noted that the Brotli v1.2.1 release has been published on GitHub. The same reply says an Aikido write-up adds the PyPI brotli packages to its list of affected packages. The feed snippet does not describe the bug, affected version range, or exploitation.
Unconfirmed: The snippet does not state the vulnerability details, affected versions, or whether it is exploited.
- The cited fixed release tag is v1.2.1.
- PyPI brotli packages are mentioned as newly listed.
- The post is a reply confirming another report, not a full advisory.
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | — | v1.2.1 |
| PyPI brotli packages | — | — |
- 1.Review the Brotli v1.2.1 release and update affected Brotli packages.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
Posted by Alan Coopersmith on Oct 24 Yes, https://patchtheplanet. org/brotli reports this as well. https://github.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.