{"id":"CVE-2026-111497","published":"2026-10-22T14:17:37Z","modified":"2026-10-30T20:30:11Z","title":"Google Brotli Unchecked Return Value Vulnerability","vendor":"Google","product":"Brotli","tier":"core","eol":null,"description":{"text":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","provenance":"source","from":"NVD"},"summary":{"text":"The Brotli decoder in Google Brotli, specifically the file c/dec/decode.c, contains a buffer overflow flaw in versions 1.0.3 through 1.2.0 on all platforms. A remote, unauthenticated attacker can exploit it by sending a crafted Brotli-compressed stream, requiring no authentication, user interaction, or special configuration, to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:57Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.82641,"percentile":0.99666,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-10-27","dueDate":"2026-11-10","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111497","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-10-26","exploitedFirstSeen":"2026-10-26","ransomware":false,"evidence":[{"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","date":"2026-10-26"},{"url":"https://previdian.com/CVE-2026-111497","date":"2026-10-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-27"},{"url":"https://www.zscaler.com/blogs/security-research/cve-2026-111497-node2shell-http2shell-vulnerability-may-allow-rce","date":"2026-10-28"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":23,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae4af0017a739f65534f550","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Node2Shell (CVE-2026-111497): Brotli RCE Exploited","url":"https://otx.alienvault.com/pulse/6ae38bc5104a1b7a03e20f92","created":"2026-10-29"},{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Node2Shell / HTTP2Shell Vulnerability May Allow RCE","url":"https://otx.alienvault.com/pulse/6ae280ad7e93493f1842dcc5","created":"2026-10-28"},{"name":"PHP2Shell: Exploitation Attempts and Remediation Trends","url":"https://otx.alienvault.com/pulse/6ae2521243ba0cbfa64c7f92","created":"2026-10-28"},{"name":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","url":"https://otx.alienvault.com/pulse/6ae2509a9663a65c020a5e77","created":"2026-10-28"},{"name":"CISA Adds Node2Shell Brotli Flaw to KEV as Honeypots Record Exploitation Attempts","url":"https://otx.alienvault.com/pulse/6ae24da917449b7675a7c464","created":"2026-10-28"},{"name":"Node2Shell / HTTP2Shell Vulnerability May Allow RCE","url":"https://otx.alienvault.com/pulse/6ae2424aa801637ecf4942df","created":"2026-10-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-252","name":"Unchecked Return Value"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7","tags":["Release Notes"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/16","tags":["Mailing List","Third Party Advisory"]},{"url":"https://broccoli2shell.com","tags":["Third Party Advisory"]},{"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","tags":["Third Party Advisory"]},{"url":"https://github.com/dotnet/announcements/issues/494","tags":["Issue Tracking","Mitigation","Third Party Advisory"]},{"url":"https://github.com/google/brotli/releases/tag/v1.0.10","tags":["Release Notes"]},{"url":"https://github.com/google/brotli/releases/tag/v1.1.1","tags":["Release Notes"]},{"url":"https://github.com/google/brotli/releases/tag/v1.2.1","tags":["Release Notes"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://patchtheplanet.org/brotli","tags":["Third Party Advisory"]},{"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-045512.html","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-443410.html","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-898633.html","tags":["Third Party Advisory"]},{"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated input via crafted stream","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows a remote unauthenticated attacker to corrupt adjacent decoder state memory","start":134,"end":215}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: memory disclosure enables data reading","mappingType":"primary_impact","evidence":[{"from":"description","quote":"disclose sensitive memory contents","start":217,"end":251}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution from memory corruption","mappingType":"primary_impact","evidence":[{"from":"description","quote":"potentially execute arbitrary code","start":283,"end":317}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: decoder crash causes denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause a denial of service","start":253,"end":278}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"PyPI","package":"brotli","vulnerableRanges":[">=1.0.3, <1.2.1","<1.2.1"],"patched":["1.2.1"],"from":["GHSA-9v8h-qqgm-4m35","PYSEC-2026-4322"],"provenance":"source"},{"ecosystem":"PyPI","package":"brotlicffi","vulnerableRanges":[">=1.0.3, <1.2.1.0","<1.2.1.0"],"patched":["1.2.1.0"],"from":["GHSA-9v8h-qqgm-4m35","PYSEC-2026-4323"],"provenance":"source"}],"advisories":[{"id":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","severity":"CRITICAL","ecosystem":"PyPI","package":"brotli","vulnerableRanges":[">=1.0.3, <1.2.1"],"patched":["1.2.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","severity":"CRITICAL","ecosystem":"PyPI","package":"brotlicffi","vulnerableRanges":[">=1.0.3, <1.2.1.0"],"patched":["1.2.1.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-108169","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108169","exploited":true,"exploitedSince":"2026-10-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":73,"skipped":5,"earliest":"2026-10-21","earliestUrl":"https://github.com/CaterMaoZi/CVE-2026-111497-POC","repos":[{"name":"assetnote/node2shell-scanner","url":"https://github.com/assetnote/node2shell-scanner","stars":85,"created":"2026-10-25"},{"name":"dimasma0305/CVE-2026-111497-POC","url":"https://github.com/dimasma0305/CVE-2026-111497-POC","stars":73,"created":"2026-10-22"},{"name":"trailofbits/brotli-checker","url":"https://github.com/trailofbits/brotli-checker","stars":65,"created":"2026-10-23"},{"name":"syrex1013/CVE-2026-111497-node2shell","url":"https://github.com/syrex1013/CVE-2026-111497-node2shell","stars":50,"created":"2026-10-24"},{"name":"caveeroo/cve-2026-111497-wordpress-poc","url":"https://github.com/caveeroo/cve-2026-111497-wordpress-poc","stars":28,"created":"2026-10-28"}]},"first":{"date":"2026-10-21","source":"PoC-in-GitHub","url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1005","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2026-10-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC","provenance":"source"},{"date":"2026-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","provenance":"source"},{"date":"2026-10-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","provenance":"source"},{"date":"2026-10-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-10-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108169","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":5},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 5 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"73 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"23 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-timlegge-io-compress-brotli-cve-2020-36846","parents":[{"from":"CVE-2020-36846","to":"CVE-2026-111497","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["c/dec/decode.c"],"commits":["https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6","https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b","https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-36846","published":"2025-05-30","fixed":"1.0.8","kev":false},{"cve":"CVE-2025-6176","published":"2025-10-31","fixed":"1.2.0","kev":false,"link":{"from":"CVE-2025-6176","to":"CVE-2026-111497","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:brotli","fromFixed":"1.2.0","toFixed":"1.2.1","daysApart":356}]}},{"cve":"CVE-2026-111497","published":"2026-10-22","fixed":"1.2.1","kev":true}],"package":"PyPI:brotli"}}