Brotli CVE-2026-111497: exploited decoder flaw, how to fix it

TL;DR

• What: a buffer overflow in the Brotli decoder, tracked as CVE-2026-111497, caused by an unchecked return value (CWE-252) that leads to an out-of-bounds write (CWE-787).
• Impact: a remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, disclose memory contents, crash the process or potentially run code.
• Severity: a CVSS v4.0 score of 9.2 (critical) from Google; NVD has not scored it yet.
• Exploited: yes, CISA added it to its Known Exploited Vulnerabilities catalogue on October 27, 2026, with a due date of November 10, 2026 for federal agencies.
• Fix: upgrade Brotli releases from 1.0.3 up to and including 1.2.0 to the fixed release in your line: 1.0.10, 1.1.1 or 1.2.1.

What the vulnerability is

Brotli is a compression format and library from Google. Web servers, browsers, build tools and language runtimes use it to shrink and expand data. The flaw sits in the decoder, the part that reads compressed data and turns it back into bytes. The code is in c/dec/decode.c.

In plain terms, the decoder does not properly check the result of one of its own internal calls. When a specially built stream reaches that code, the decoder can write outside the memory it was given. The bytes it overwrites are the adjacent decoder state, which is exactly the kind of memory an attacker wants to control.

The description published in the National Vulnerability Database says an attacker can use this to corrupt that memory, leak data held in memory, crash the service, or potentially run code of their choosing. No login is needed and the attack comes over the network, so any service that decodes Brotli data from an untrusted source is a possible target.

Why it matters now

Two things make this one urgent. First, it is confirmed as exploited: CISA put it in the Known Exploited Vulnerabilities catalogue on October 27, 2026. Second, Brotli is a shared component. CISA's own note says the flaw affects an open-source component that other products embed, so the vulnerable code may be inside software you never installed as "Brotli". It can sit in a system package, in a language library, in a statically linked binary or in a container image.

The NVD entry was published on October 22, 2026 and is still marked as undergoing analysis. That means scanners that depend on a structured list of affected products have nothing to match yet. The description does give a clear version range, and the vendor release notes name the fixed versions, so you can act today without waiting for the record to be completed.

Am I affected?

The affected range is Brotli from 1.0.3 up to and including 1.2.0, on all platforms. The three fixed releases are 1.0.10, 1.1.1 and 1.2.1. If you run anything older than 1.0.3, the description does not say whether it is affected, so check the vendor release notes rather than assuming it is safe.

To check one Linux machine by hand, look at the system package and at any copy of the command line tool:

brotli --version
dpkg -l | grep -i brotli
rpm -qa | grep -i brotli

Use the line that matches your package manager. That only covers the system copy. Brotli is also built into other software, so look for bundled copies in application directories, vendored source trees, language package lock files and container images.

Backport caveat: Linux distributions frequently patch a security flaw in place and keep the old version number. A server that reports a version inside the affected range may already carry the fix. Read your distribution's security notice for Brotli before you decide whether a machine is exposed, and prefer the packaged update over replacing the library by hand.

How to fix CVE-2026-111497

1. Find every Brotli copy in the affected range (from 1.0.3 up to and including 1.2.0), including the ones bundled inside applications and container images.
2. Update system packages through your distribution's normal channel, then restart services that keep the library loaded so the new code is used.
3. For software you build yourself, move to the latest release of your line: 1.0.10, 1.1.1 or 1.2.1, then rebuild and redeploy.
4. Rebuild container images from an updated base image and roll them out, rather than patching running containers.
5. If a product bundles its own Brotli and has no update yet, follow that vendor's mitigation guidance, as CISA's required action says, or stop using the product if no mitigation exists.

Because the flaw is exploited, also review exposed services that decode Brotli data for signs of compromise from before the patch.

How to check with Stackurity

The hard part of a flaw like this is finding every copy. Stackurity keeps one live inventory of the software on your servers, deployed applications, repositories, container images, Kubernetes workloads and AWS managed services. A read-only agent on Linux servers reads installed packages, runtimes installed by hand and the libraries that deployed applications actually load, so Brotli installed as a system package, or as a library through a supported package manager, shows up in the inventory, and so does Brotli inside a container image.

Stackurity matches that inventory every hour against vulnerability and end-of-life data, including the CISA Known Exploited Vulnerabilities catalogue, using each ecosystem's own version rules so that distribution backports are not reported as false alarms. Each finding says in one sentence why it applies, and each fix is one card with the version to move to.

After you upgrade, the check again step asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can show the fix is real. Stackurity also has a CI gate, stackurity scan --fail-on, that stops a vulnerable change before it ships. The Community edition is free and self-hosted, and Stackurity Cloud has a 14-day free trial without a card.

FAQ

Is CVE-2026-111497 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on October 27, 2026. CISA lists known ransomware campaign use as unknown, so treat it as exploited but not yet tied to a named campaign.

Which Brotli versions are fixed?

The NVD description says anyone running Brotli from 1.0.3 up to and including 1.2.0 should upgrade to the newest release in their line, which is 1.0.10, 1.1.1 or 1.2.1.

Does the NVD list affected product versions for this CVE?

Not yet. The NVD entry is still undergoing analysis and its affected list is empty, so rely on the version range in the description and on the vendor release notes.

Can a Linux distribution fix this without changing the version number?

Yes. Distributions often backport a fix and keep the old version string, so a package that looks old may already be patched. Check the distribution's security notice before you assume a server is exposed.

How does Stackurity help with this?

Stackurity keeps one inventory of the software on your servers and container images, matches it every hour against the CISA Known Exploited Vulnerabilities catalogue and other data, and checks again after the fix to record whether the issue is gone.

Related: CISA adds two exploited PHP flaws to its catalogue. To see which of your servers and images carry Brotli, start with the installation guide and the list of supported systems.

Sources: CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database and Stackurity product overview.