Skip to content

CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

CriticalCVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 · due 2026-11-10 Exploited in the wild PoC
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CISA Known Exploited Vulnerability

Date added
2026-10-27
Due date (FCEB)
2026-11-10
Ransomware use
Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected products

ProductAffected versionsFixed in
pypi brotli(PyPI) >= 1.0.3, < 1.2.1 1.2.1
pypi brotli(PyPI) = 1.0.4 No fix listed
pypi brotli(PyPI) = 1.0.6 No fix listed
pypi brotli(PyPI) = 1.0.7 No fix listed
pypi brotli(PyPI) = 1.0.8 No fix listed
pypi brotli(PyPI) = 1.0.9 No fix listed
pypi brotli(PyPI) = 1.1.0 No fix listed
pypi brotli(PyPI) = 1.2.0 No fix listed
pypi brotlicffi(PyPI) >= 1.0.3, < 1.2.1.0 1.2.1.0
pypi brotlicffi(PyPI) = 1.0.9.0 No fix listed
pypi brotlicffi(PyPI) = 1.0.9.1 No fix listed
pypi brotlicffi(PyPI) = 1.0.9.2 No fix listed
pypi brotlicffi(PyPI) = 1.1.0.0 No fix listed
pypi brotlicffi(PyPI) = 1.2.0.0 No fix listed
pypi brotlicffi(PyPI) = 1.2.0.1 No fix listed
pypi brotlicffi(PyPI) = 1.2.0.2 No fix listed
pypi brotli(PyPI) < 1.2.1 1.2.1
pypi brotli(PyPI) = 0.5.2 No fix listed
pypi brotli(PyPI) = 0.6.0 No fix listed
pypi brotli(PyPI) = 1.0.1 No fix listed
pypi brotlicffi(PyPI) < 1.2.1.0 1.2.1.0
pypi brotlicffi(PyPI) = 0.8.0 No fix listed
andybalholm github.com/andybalholm/brotli(Go) < 1.2.7 1.2.7
redhat/python3.12-brotli(Red Hat:ansible_automation_platform:2.4::el8) < 1.2.1-1.el8ap 1.2.1-1.el8ap
redhat/python3.12-brotli(Red Hat:ansible_automation_platform:2.4::el9) < 1.2.1-1.el9ap 1.2.1-1.el9ap
Show 175 more
ProductAffected versionsFixed in
redhat/python3.12-brotli(Red Hat:ansible_automation_platform:2.5::el8) < 1.2.1-1.el8ap 1.2.1-1.el8ap
redhat/python3.12-brotli(Red Hat:ansible_automation_platform:2.5::el9) < 1.2.1-1.el9ap 1.2.1-1.el9ap
redhat/python3.12-brotli(Red Hat:ansible_automation_platform:2.6::el9) < 1.2.1-1.el9ap 1.2.1-1.el9ap
redhat/com.aayushatharva.brotli4j/native-linux-x86_64:1.24.0.redhat-00001(Red Hat:apache_camel_quarkus:3.33::el6) All versions No fix listed
redhat/native-linux-x86_64(Red Hat:quarkus:3.27) All versions No fix listed
redhat/native-linux-x86_64(Red Hat:quarkus:3.33) All versions No fix listed
redhat/firefox(Red Hat:enterprise_linux:10.1) < 140.10.0-1.el10_1 140.10.0-1.el10_1
redhat/thunderbird(Red Hat:enterprise_linux:10.2) < 140.10.0-1.el10_2 140.10.0-1.el10_2
redhat/brotli(Red Hat:enterprise_linux:10.2) < 1.1.0-8.el10_2.1 1.1.0-8.el10_2.1
redhat/dotnet8.0(Red Hat:enterprise_linux:10.2) < 8.0.133-1.el10_2 8.0.133-1.el10_2
redhat/firefox(Red Hat:enterprise_linux_eus:10.0) < 140.10.0-1.el10_0 140.10.0-1.el10_0
redhat/thunderbird(Red Hat:enterprise_linux_eus:10.0) < 140.10.0-1.el10_0 140.10.0-1.el10_0
redhat/brotli(Red Hat:enterprise_linux_eus:10.0) < 1.1.0-6.el10_0.3 1.1.0-6.el10_0.3
redhat/dotnet8.0(Red Hat:enterprise_linux_eus:10.0) < 8.0.133-1.el10_0 8.0.133-1.el10_0
redhat/firefox(Red Hat:rhel_els:7) < 140.10.0-2.el7_9 140.10.0-2.el7_9
redhat/firefox(Red Hat:enterprise_linux:8) < 140.10.0-1.el8_10 140.10.0-1.el8_10
redhat/thunderbird(Red Hat:enterprise_linux:8) < 140.10.0-1.el8_10 140.10.0-1.el8_10
redhat/brotli(Red Hat:enterprise_linux:8) < 1.0.6-5.el8_10 1.0.6-5.el8_10
redhat/nodejs:24-8100020261027151919.6d880403(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/dotnet8.0(Red Hat:enterprise_linux:8) < 8.0.133-1.el8_10 8.0.133-1.el8_10
redhat/thunderbird(Red Hat:rhel_aus:8.4) < 140.10.0-1.el8_4 140.10.0-1.el8_4
redhat/firefox(Red Hat:rhel_aus:8.4) < 140.10.0-1.el8_4 140.10.0-1.el8_4
redhat/brotli(Red Hat:rhel_aus:8.4) < 1.0.6-4.el8_4.1 1.0.6-4.el8_4.1
redhat/thunderbird(Red Hat:rhel_eus_long_life:8.4) < 140.10.0-1.el8_4 140.10.0-1.el8_4
redhat/firefox(Red Hat:rhel_eus_long_life:8.4) < 140.10.0-1.el8_4 140.10.0-1.el8_4
redhat/brotli(Red Hat:rhel_eus_long_life:8.4) < 1.0.6-4.el8_4.1 1.0.6-4.el8_4.1
redhat/thunderbird(Red Hat:rhel_aus:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/firefox(Red Hat:rhel_aus:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/brotli(Red Hat:rhel_aus:8.6) < 1.0.6-4.el8_6.1 1.0.6-4.el8_6.1
redhat/brotli(Red Hat:rhel_eus_long_life:8.6) < 1.0.6-4.el8_6.1 1.0.6-4.el8_6.1
redhat/thunderbird(Red Hat:rhel_tus:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/firefox(Red Hat:rhel_tus:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/thunderbird(Red Hat:rhel_e4s:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/firefox(Red Hat:rhel_e4s:8.6) < 140.10.0-1.el8_6 140.10.0-1.el8_6
redhat/firefox(Red Hat:rhel_tus:8.8) < 140.10.0-1.el8_8 140.10.0-1.el8_8
redhat/thunderbird(Red Hat:rhel_tus:8.8) < 140.10.0-1.el8_8 140.10.0-1.el8_8
redhat/brotli(Red Hat:rhel_tus:8.8) < 1.0.6-4.el8_8.1 1.0.6-4.el8_8.1
redhat/firefox(Red Hat:rhel_e4s:8.8) < 140.10.0-1.el8_8 140.10.0-1.el8_8
redhat/thunderbird(Red Hat:rhel_e4s:8.8) < 140.10.0-1.el8_8 140.10.0-1.el8_8
redhat/brotli(Red Hat:rhel_e4s:8.8) < 1.0.6-4.el8_8.1 1.0.6-4.el8_8.1
redhat/firefox(Red Hat:enterprise_linux:9) < 140.10.0-1.el9_7 140.10.0-1.el9_7
redhat/thunderbird(Red Hat:enterprise_linux:9) < 140.10.0-1.el9_7 140.10.0-1.el9_7
redhat/brotli(Red Hat:enterprise_linux:9) < 1.0.9-10.el9_8.1 1.0.9-10.el9_8.1
redhat/nodejs:24-9080020261027142403.rhel9(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/dotnet8.0(Red Hat:enterprise_linux:9) < 8.0.133-1.el9_8 8.0.133-1.el9_8
redhat/firefox(Red Hat:rhel_e4s:9.0) < 140.10.0-1.el9_0 140.10.0-1.el9_0
redhat/thunderbird(Red Hat:rhel_e4s:9.0) < 140.10.0-1.el9_0 140.10.0-1.el9_0
redhat/firefox(Red Hat:rhel_e4s:9.2) < 140.10.0-1.el9_2 140.10.0-1.el9_2
redhat/thunderbird(Red Hat:rhel_e4s:9.2) < 140.10.0-1.el9_2 140.10.0-1.el9_2
redhat/brotli(Red Hat:rhel_e4s:9.2) < 1.0.9-6.el9_2.3 1.0.9-6.el9_2.3
redhat/firefox(Red Hat:rhel_eus:9.4) < 140.10.0-1.el9_4 140.10.0-1.el9_4
redhat/thunderbird(Red Hat:rhel_eus:9.4) < 140.10.0-1.el9_4 140.10.0-1.el9_4
redhat/brotli(Red Hat:rhel_e4s:9.4) < 1.0.9-6.el9_4.3 1.0.9-6.el9_4.3
redhat/dotnet8.0(Red Hat:rhel_e4s:9.4) < 8.0.133-1.el9_4 8.0.133-1.el9_4
redhat/firefox(Red Hat:rhel_eus:9.6) < 140.10.0-1.el9_6 140.10.0-1.el9_6
redhat/thunderbird(Red Hat:rhel_eus:9.6) < 140.10.0-1.el9_6 140.10.0-1.el9_6
redhat/brotli(Red Hat:rhel_eus:9.6) < 1.0.9-7.el9_6.3 1.0.9-7.el9_6.3
redhat/dotnet8.0(Red Hat:rhel_eus:9.6) < 8.0.133-1.el9_6 8.0.133-1.el9_6
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.13::el9) < 9:413.92.202611041925-0 9:413.92.202611041925-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.14::el9) < 9:414.92.202611040941-0 9:414.92.202611040941-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.17::el9) < 9:417.94.202611061051-0 9:417.94.202611061051-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.19::el9) < 9:4.19.9.6.202611041921-0 9:4.19.9.6.202611041921-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.20::el9) < 9:4.20.9.6.202611042002-0 9:4.20.9.6.202611042002-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.21::el9) < 9:4.21.9.6.202611042115-0 9:4.21.9.6.202611042115-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.22::el9) < 9:4.22.9.8.202611032353-0 9:4.22.9.8.202611032353-0
redhat/python-brotli(Red Hat:satellite:6.16::el8) < 1.2.1-1.el8pc 1.2.1-1.el8pc
redhat/python-pyyaml(Red Hat:satellite:6.16::el8) < 6.0.1-1.el8pc 6.0.1-1.el8pc
redhat/python-brotli(Red Hat:satellite_capsule:6.16::el8) < 1.2.1-1.el8pc 1.2.1-1.el8pc
redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el8) < 6.0.1-1.el8pc 6.0.1-1.el8pc
redhat/python-brotli(Red Hat:satellite:6.16::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python-pyyaml(Red Hat:satellite:6.16::el9) < 6.0.1-1.el9pc 6.0.1-1.el9pc
redhat/python-brotli(Red Hat:satellite_capsule:6.16::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el9) < 6.0.1-1.el9pc 6.0.1-1.el9pc
redhat/python-brotli(Red Hat:satellite:6.17::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python-brotli(Red Hat:satellite_capsule:6.17::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python3.12-brotli(Red Hat:satellite:6.18::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python3.12-brotli(Red Hat:satellite_capsule:6.18::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python3.12-brotli(Red Hat:satellite:6.19::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/python3.12-brotli(Red Hat:satellite_capsule:6.19::el9) < 1.2.1-1.el9pc 1.2.1-1.el9pc
redhat/ansible-automation-platform-26/ee-supported-rhel9:1793123621(Red Hat:ansible_automation_platform:2.6::el9) All versions No fix listed
redhat/ansible-automation-platform-27/ee-supported-rhel9:1793362297(Red Hat:ansible_automation_platform:2.7::el9) All versions No fix listed
redhat/discovery/discovery-ui-rhel9:1793733716(Red Hat:discovery:2::el9) All versions No fix listed
redhat/brotli-main(Red Hat:hummingbird:1) < 1.2.1-0.1.hum1 1.2.1-0.1.hum1
redhat/dotnet8-0-main(Red Hat:hummingbird:1) < 8.0.133-0.1.hum1 8.0.133-0.1.hum1
redhat/dotnet8-0-main(Red Hat:hummingbird:1) < 8.0.33-0.1.hum1 8.0.33-0.1.hum1
redhat/rhai/base-image-tpu-rhel9:1793329706(Red Hat:openshift_ai:3.0::el9) All versions No fix listed
redhat/rhai/base-image-cpu-rhel9:1793329709(Red Hat:openshift_ai:3.0::el9) All versions No fix listed
redhat/rhai/base-image-spyre-rhel9:1793327611(Red Hat:openshift_ai:3.0::el9) All versions No fix listed
redhat/rhai/base-image-rocm-rhel9:1793329305(Red Hat:openshift_ai:3.0::el9) All versions No fix listed
redhat/rhai/base-image-cuda-rhel9:1793328358(Red Hat:openshift_ai:3.0::el9) All versions No fix listed
redhat/rhoai/odh-mlserver-rhel9:1793110755(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhoai/odh-trustyai-service-rhel9:1793295660(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-tpu-rhel9:1793330461(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-cpu-rhel9:1793327311(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-neuron-rhel9:1793329624(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-spyre-rhel9:1793326217(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-gaudi-rhel9:1793327499(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-rocm-6.4-rhel9:1793329011(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-cuda-13.0-rhel9:1793326837(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-cuda-12.9-rhel9:1793326796(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-rocm-7.1-rhel9:1793330096(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhai/base-image-neuron-rhel9:1793326392(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-tpu-rhel9:1793328643(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-gaudi-rhel9:1793327512(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-cpu-rhel9:1793330940(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-rubin-rhel9:1793329296(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-cuda-13.0-rhel9:1793329271(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-rocm-7.14-rhel9:1793326530(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-spyre-rhel9:1793330882(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/rhai/base-image-cuda-12.9-rhel9:1793327660(Red Hat:openshift_ai:3.5::el9) All versions No fix listed
redhat/devspaces/udi-base-rhel10:1793289932(Red Hat:openshift_devspaces:3.31::el10) All versions No fix listed
redhat/devspaces/code-rhel9:1793303920(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/devspaces/code-sshd-rhel9:1793302377(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/devspaces/jetbrains-ide-rhel9:1793286590(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/devspaces/multicluster-redirector-rhel9:1793381243(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/devspaces/server-rhel9:1793222748(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/devspaces/udi-rhel9:1793463029(Red Hat:openshift_devspaces:3.31::el9) All versions No fix listed
redhat/exploit-intelligence/agent-client-rhel9(Red Hat:exploit_intelligence:0) All versions No fix listed
redhat/exploit-intelligence/vulnerability-analysis-rhel9(Red Hat:exploit_intelligence:0) All versions No fix listed
redhat/ansible-automation-platform/automation-dashboard-rhel9(Red Hat:ansible_automation_platform:2) All versions No fix listed
redhat/native-linux-x86_64(Red Hat:camel_quarkus:3) All versions No fix listed
redhat/native-linux-x86_64(Red Hat:apicurio_registry:3) All versions No fix listed
redhat/native-linux-x86_64(Red Hat:debezium:3) All versions No fix listed
redhat/rhdh/rhdh-hub-rhel9(Red Hat:rhdh:1) All versions No fix listed
redhat/rhdh/rhdh-hub-rhel9(Red Hat:rhdh:2) All versions No fix listed
redhat/nodejs:26/nodejs(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/jbcs-httpd24-brotli(Red Hat:jboss_core_services:1) All versions No fix listed
redhat/rhoai/odh-mlserver-cuda-rhel9(Red Hat:openshift_ai) All versions No fix listed
redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) All versions No fix listed
redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) All versions No fix listed
redhat/satellite/iop-remediations-rhel9(Red Hat:satellite:6) All versions No fix listed
Google github.com/google/brotli >= 1.0.3, < 1.0.10 1.0.10
Google github.com/google/brotli >= 1.1.0, < 1.1.1 1.1.1
Google github.com/google/brotli >= 1.2.0, < 1.2.1 1.2.1
Siemens Cloud Connector Configurator < V1.24.3 V1.24.3
Siemens Common Configurator (CC on IEM) All versions No fix listed
Siemens Common Configurator on Device (CC on Edge) All versions No fix listed
Siemens COMOS Walkinside All versions No fix listed
Siemens Data Flow Monitoring < V3.0.18 V3.0.18
Siemens Databus Configurator < V4.0.1 V4.0.1
Siemens DataXess Configurator < V1.5.7 V1.5.7
Siemens Desigo CC family V8 All versions No fix listed
Siemens Desigo CC family V9 All versions No fix listed
Siemens Edge OPC UA Server Configurator < V2.3.10 V2.3.10
Siemens Flow Creator Configurator < V1.15.1 V1.15.1
Siemens Gridscale X DSA >= V5.3, < V5.4 V5.4
Siemens Gridscale X PSS®E < V36.8.0 V36.8.0
Siemens HyperLynx All versions No fix listed
Siemens Industrial Edge Hub All versions No fix listed
Siemens Industrial Edge Management Cloud All versions No fix listed
Siemens Innexis Architecture Native Acceleration 2026 All versions No fix listed
Siemens Insights Hub All versions No fix listed
Siemens Opcenter Connect Electronics All versions No fix listed
Siemens Opcenter Connect MOM All versions No fix listed
Siemens Opcenter Execution Core All versions No fix listed
Siemens Opcenter Execution Discrete All versions No fix listed
Siemens Opcenter Execution Foundation All versions No fix listed
Siemens Opcenter Execution Pharma All versions No fix listed
Siemens Opcenter Execution Process All versions No fix listed
Siemens Opcenter Intelligence All versions No fix listed
Siemens Opcenter Intra Plant Logistics All versions No fix listed
Siemens Opcenter Quality All versions No fix listed
Siemens Opcenter RDnL All versions No fix listed
Siemens Opcenter X All versions No fix listed
Siemens PADS Pro Essentials All versions No fix listed
Siemens PADS Pro Student Edition All versions No fix listed
Siemens PADS Professional All versions No fix listed
Siemens PAVE360 Automotive 2026 All versions No fix listed
Siemens Process Preparation X All versions No fix listed
Siemens Project Server Web Administration Tool All versions No fix listed
Siemens SIMATIC BRAUMAT >= V8.2 Update 1, < V8.2 Update 5 V8.2 Update 5
Siemens SIMATIC Profiling Tool All versions No fix listed
Siemens SIMATIC SISTAR >= V8.2 Update 1, < V8.2 Update 5 V8.2 Update 5
Siemens SIMATIC WinCC Companion All versions No fix listed
Siemens SIMATIC WinCC OA V3.20 < V3.20 P17.1 V3.20 P17.1

References