Google · Brotli
The Brotli decoder in Google Brotli, specifically the file c/dec/decode.c, contains a buffer overflow flaw in versions 1.0.3 through 1.2.0 on all platforms. A remote, unauthenticated attacker can exploit it by sending a crafted Brotli-compressed stream, requiring no authentication, user interaction, or special configuration, to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
First seen exploited 4 days after disclosure. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
2 related vulnerabilities in the same code over 17 months. The latest fix listed for brotli is 1.2.1.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
remote unauthenticated input via crafted stream
allows a remote unauthenticated attacker to corrupt adjacent decoder state memory
arbitrary code execution from memory corruption
potentially execute arbitrary code
memory disclosure enables data reading
disclose sensitive memory contents
decoder crash causes denial of service
cause a denial of service
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
2 packages in 1 ecosystem. Main package: brotli.
Upgrade to 1.2.1 or later
pip install "brotli>=1.2.1"The first fix for CVE-2026-111497. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.2.1 | 1.2.1 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.