CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Summary

Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.

erl-brotli compiles its own copy of the Google Brotli C sources under c_src into a NIF, and brotli_decoder_decompress_stream in c_src/brotli_nif.c hands the input to BrotliDecoderDecompressStream. In c_src/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.

This issue affects brotli: from 0.3.0 before 0.3.4.

Impact

An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Python CFFI bindings to the Brotli library.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Python CFFI bindings to the Brotli library.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Python CFFI bindings to the Brotli library.

Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous value for an invalid block switch, and the fast decode path discards it (CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder continue on corrupted state and write past the ring buffer. Upstream rates it CVSS 4.0 9.2 and classifies the impact as potential remote code execution.

The vulnerability is in Google's C library, not in Node.js specifically. The PyPI Brotli package is Google's CPython binding and compiles the same c/dec/decode.c that has the actual vulnerability. All Brotli releases up to and including 1.2.0 ship the vulnerable decoder; 1.2.1 contains the upstream fix (commit 0ed4268a) and differs from 1.2.0 only in that fix plus a version bump.

The decoder is reached whenever untrusted Brotli data is decompressed. With Brotli installed, common HTTP clients decode Brotli responses automatically (urllib3/requests, httpx with the brotli extra, aiohttp) and services that accept Content-Encoding: br request bodies decode inbound data, so the flaw is reachable from attacker-controlled input.

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous value for an invalid block switch, and the fast decode path discards it (CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder continue on corrupted state and write past the ring buffer. Upstream rates it CVSS 4.0 9.2 and classifies the impact as potential remote code execution.

The vulnerability is in Google's C library, not in Node.js specifically. The PyPI Brotli package is Google's CPython binding and compiles the same c/dec/decode.c that has the original vulnerability. All Brotli releases up to and including 1.2.0 ship the vulnerable decoder; 1.2.1 contains the upstream fix (commit 0ed4268a) and differs from 1.2.0 only in that fix plus a version bump.

The decoder is reached whenever untrusted Brotli data is decompressed. With brotlicffi installed, common HTTP clients decode Brotli responses automatically (urllib3/requests, httpx with the brotli extra, aiohttp) and services that accept Content-Encoding: br request bodies decode inbound data, so the flaw is reachable from attacker-controlled input.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133 Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:Rocky Linux-291714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133 Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:Rocky Linux-291718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133 Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:Rocky Linux-291717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)
• firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)
• firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)
• firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)
• firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)
• firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)
• firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)
• firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)
• firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)
• firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)
• firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)
• firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)
• firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)
• firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)
• firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)
• firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)
• firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)
• firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)
• firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)
• firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)
• firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)
• firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)
• firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)
• firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)
• firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)
• firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)
• firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)
• firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)
• firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)
• firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)
• firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)
• firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)
• firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)
• firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)
• firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)
• firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)
• firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)
• firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)
• firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:RHEL-291714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:RHEL-291718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:RHEL-291717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

• CVE-2026-111497: report an error on an invalid block switch in the decoder instead of silently ignoring it

• CVE-2026-111497: report an error on an invalid block switch in the decoder instead of silently ignoring it

• SECURITY UPDATE: Invalid stream not detected during block switch decoding
  • debian/patches/CVE-2026-111497.patch: return an error code from the literal/command/distance block-switch decoders and abort decoding with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c, c/include/brotli/decode.h
  • CVE-2026-111497

• SECURITY UPDATE: Out-of-bounds write via invalid block switch in decoder
  • debian/patches/CVE-2026-111497.patch: abort decoding with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c
  • CVE-2026-111497

• SECURITY UPDATE: Invalid stream not detected during block switch decoding
  • debian/patches/CVE-2026-111497.patch: return an error code from the literal/command/distance block-switch decoders and abort decoding with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c, c/include/brotli/decode.h
  • CVE-2026-111497