Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. ASP.NET...

Elastic Maps Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-238)

Out-of-bounds Write in Elastic Maps Server Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder used by the Node.js runtime, a dependency of Elastic Maps Server Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to corrupt memory and...

Elastic Agent 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-234)

Out-of-bounds Write in Elastic Agent Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Elastic Agent Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or...

Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-233)

Out-of-bounds Write in Heartbeat Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Heartbeat Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or potentially...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-232)

Out-of-bounds Write in Kibana Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Kibana Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to corrupt memory and potentially execute code in the Kibana server...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available Red Hat build of Quarkus 3.33.4.SP2. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.4.SP2 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for the vulnerability. For more information...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6.SP2 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for the vulnerability. For more information...

Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...

SUSE-SU-2026:5037-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...

Security update for nodejs22

This update for nodejs22 fixes the following issues: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-106069: TLS certificate hostname bypass when th...

SUSE-SU-2026:5036-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...

Important: Red Hat Security Advisory: .NET 8.0 security update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: .NET 8.0 security update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Node.js 24.22.0 Brotli Decoder Remote Code Execution

Node.js version 24.22.0 contains an out-of-bounds write in the Brotli decoder. A proof of concept demonstrates remote code execution through a crafted Brotli-compressed HTTP request. https://packetstorm.news/download/238892...

Node.js 26.12.0 Brotli Decoder Remote Code Execution

Node.js versions 22.x, 24.x, and 26.x contain an out-of-bounds write in the Brotli decoder that may permit remote code execution when an application decompresses attacker-controlled Brotli data. https://packetstorm.news/download/238907...

WordPress 7.1.3 Pingback Brotli Decoder Remote Code Execution

A proof of concept demonstrates reaching a vulnerable native Brotli decoder through the WordPress version 7.1.3 pingback path to execute a fixed id command in a local Podman lab. https://packetstorm.news/download/238897...

SUSE CVE-2026-115946

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or...