Zero Radar
← feed
CriticalVulnerabilityCVE-2026-111497updated 29 Oct 2026, 20:46 UTC

Brotli decompression flaw can let attackers crash or take over software

A widely used compression library can be tricked by a specially crafted compressed file or web response into corrupting memory. This can crash programs, leak data, or in some cases let an attacker run their own code.

Exploited (CISA KEV, NVD)Fix availableOfficial, 17 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?YesConfirmed by CISA KEV, NVD, SecurityWeek, BleepingComputer · 27 Oct 2026
Fix available?Yes- pip brotli 1.2.1 - pip brotlicffi 1.2.1.0 - Brotli 1.0.10, 1.1.1, or 1.2.1 (per NVD guidance) - PHP Windows builds with the -1 suffix (includes Brotli 1.2.1; PHP runtime versions unchanged) - Node.js October 2026 security release for 22.x, 24.x, 26.x · since 25 Oct 2026
How sure is this?Official, 17 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted dataCompressed stream sent to a target
  2. 2Target decompresses itBrotli decoder processes the stream
  3. 3Memory overflow occursAdjacent decoder memory is corrupted
  4. 4Attacker gains controlData leak, crash, or code execution
  5. ResultAttacker may run code or steal memory

What happened

CVE-2026-111497 is an out-of-bounds write (buffer overflow) in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0, on all platforms. A crafted Brotli-compressed stream can corrupt adjacent decoder memory.

Why it is dangerous: A remote, unauthenticated attacker can use a crafted stream to disclose sensitive memory, cause denial of service, or potentially execute arbitrary code. Exploitation has been confirmed by CISA, and Cisco rates it High.

Are you affected?

You are affected if you use Brotli 1.0.3 through 1.2.0 (as the pip packages brotli or brotlicffi, or Brotli libraries/binaries), including PHP Windows builds with the cURL extension and automatic HTTP response decompression enabled, or Node.js releases in the 22.x, 24.x, and 26.x lines that bundle the affected decoder.

Package / productAffected versionsFixed in
brotli · pip>= 1.0.3, < 1.2.11.2.1
brotlicffi · pip>= 1.0.3, < 1.2.1.01.2.1.0

What to do

  1. Update the Brotli library: pip brotli to 1.2.1 or later, pip brotlicffi to 1.2.1.0 or later, or Brotli to 1.0.10, 1.1.1, or 1.2.1
  2. Update PHP Windows builds to the -1 rebuild (8.2.35-1 or the matching -1 build for your branch) if you use the cURL extension
  3. Update Node.js to the fixed release from the October 2026 Node.js security release for your release line (22.x, 24.x, or 26.x)
  4. Check internet-exposed systems for signs of compromise, since exploitation is confirmed

Timeline

  1. 22 Oct 2026, 07:47 UTC
    Publicly disclosed
  2. 22 Oct 2026, 07:47 UTC
    Reported by The Hacker News · The Hacker News
  3. 22 Oct 2026, 14:17 UTC
    Reported by NVD · NVD
  4. 23 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  5. 23 Oct 2026, 08:40 UTC
    Reported by The Hacker News · The Hacker News
  6. 24 Oct 2026, 11:09 UTC
    Reported by The Hacker News · The Hacker News
  7. 24 Oct 2026, 16:36 UTC
    Reported by oss-security · oss-security
  8. 25 Oct 2026, 15:20 UTC
    Wiz Research reported on it · Wiz Research
  9. 25 Oct 2026, 17:03 UTC
    Microsoft MSRC reported on it · Microsoft MSRC
  10. 26 Oct 2026, 02:05 UTC
    Reported by oss-security · oss-security
  11. 26 Oct 2026, 02:11 UTC
    Reported by oss-security · oss-security
  12. 26 Oct 2026, 15:39 UTC
    BleepingComputer reported on it · BleepingComputer
  13. 26 Oct 2026, 16:27 UTC
    Reported by BleepingComputer · BleepingComputer
  14. 26 Oct 2026, 16:40 UTC
    Reported by oss-security · oss-security
  15. 26 Oct 2026, 17:01 UTC
    Fortinet PSIRT reported on it · Fortinet PSIRT
  16. 26 Oct 2026, 17:26 UTC
    Ubuntu Security reported on it · Ubuntu Security
  17. 26 Oct 2026, 17:45 UTC
    Reported by The Hacker News · The Hacker News
  18. 26 Oct 2026, 18:37 UTC
    Palo Alto Networks reported on it · Palo Alto Networks
  19. 26 Oct 2026, 22:09 UTC
    Socket reported on it · Socket
  20. 27 Oct 2026, 10:03 UTC
    PHP reported on it · PHP
  21. 27 Oct 2026, 19:46 UTC
    CISA reported on it · CISA
  22. 27 Oct 2026, 19:51 UTC
    CISA KEV reported on it · CISA KEV
  23. 27 Oct 2026, 19:51 UTC
    Confirmed by CISA KEV
  24. 27 Oct 2026, 21:14 UTC
    Reported by Ubuntu Security · Ubuntu Security
  25. 27 Oct 2026, 21:32 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  26. 28 Oct 2026, 05:42 UTC
    Reported by The Hacker News · The Hacker News
  27. 28 Oct 2026, 08:40 UTC
    SecurityWeek reported on it · SecurityWeek
  28. 28 Oct 2026, 10:46 UTC
    Reported by BleepingComputer · BleepingComputer
  29. 28 Oct 2026, 20:36 UTC
    Reported by Cisco PSIRT · Cisco PSIRT
  30. 29 Oct 2026, 14:34 UTC
    GitHub Advisory reported on it · GitHub Advisory
  31. 29 Oct 2026, 14:34 UTC
    Fixed version published: brotli 1.2.1, brotlicffi 1.2.1.0 · GitHub Advisory
  32. 29 Oct 2026, 17:02 UTC
    Reported by Ubuntu Security · Ubuntu Security

Sources 29 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
CVE-2026-111497 · ZR-2628e8e1 · ZR-29143f2a · ZR-cf08225e · ZR-609ec7d9 · GHSA-9v8h-qqgm-4m35
CVSS
9.2 / 10
EPSS
83% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 07:47 UTC
On Zero Radar
before the radar started
Last change
29 Oct 2026, 20:46 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Brotli decompression flaw can let attackers crash or take over software · Zero Radar