cyber.hendryadrian.com
Vulnerability & Exploit · cyber.gc.ca

Cyber Centre Warns of Critical Google Brotli Vulnerability CVE-2026-111497

· Original article ↗

Summary

The Canadian Cyber Centre warns that CVE-2026-111497, a remotely exploitable out-of-bounds write in the Google Brotli decoder, could cause memory corruption, information disclosure, crashes or code execution. CISA added it to its KEV database.

Key points

  • CVE-2026-111497, also called Broccoli2Shell, affects the Google Brotli decoder and is an out-of-bounds write (CWE-787).
  • An attacker could exploit it remotely without authentication by sending specially crafted compressed data.
  • Potential impacts include memory corruption, sensitive-information disclosure, process crashes or arbitrary code execution in affected applications or services.
  • The alert identifies affected technologies including Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages.
  • CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities database on October 27, 2026.
  • Organizations are advised to identify vulnerable components, prioritize internet-facing systems, and apply applicable security updates promptly.
  • Until updates can be applied, organizations should prevent affected applications from processing Brotli-compressed content from untrusted sources and monitor for suspicious activity.

Article Details

Vulnerability Types
  • Out-of-bounds write (CWE-787)
Severity
Critical
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Until an update can be applied, prevent affected applications from processing Brotli-compressed content from untrusted sources.

Vendors

GoogleThe Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting the Google Brotli compression libraryFootnote 1. In response to the vendor advisory, the Cyber Centre released an

Products

Bunrely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.Envoyvulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.IstioBrotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.Microsoft .NETproducts that bundle or rely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.Node.jsand products that bundle or rely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages,PowerShellbundle or rely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.

Related Articles