brotli-checker

Brotli Checker Brotli Checker finds copies of the Brotli decoder that may need an update for CVE-2026-111497. Install it as a Claude Code or Codex skill, then ask it to check your project. The skill scans source, dependencies, app packages, and unpacked container filesystems. It checks source...

brotli-cve-check

brotli-cve-check Scans a project or container image for CVE-2026-111497 , a buffer overflow in the Brotli decoder. It rates the criticality as Critical, High, or Medium and lists the steps to fix it. The repo ships two pieces: Script skills/brotli-cve-check/scripts/brotlicheck.py: does the actual...

CVE-2026-128014

The FrankenPHP standalone static binaries versions 1.8.0 before 1.13.2 are vulnerable to an out-of-bounds write due to a statically linked Brotli 1.2.0 decoder (CVE-2026-111497). Unauthenticated remote attackers can provide crafted data to applications calling brotli_uncompress_add() , potentiall...

CVE-2026-128014 FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder

FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write CVE-2026-111497. Unauthenticated remote attackers can send crafted data to applications that pass it to brotliuncompressadd ...

CLEANSTART-2026-AG75681 buffer overflow vulnerability in the Brotli decoder (c/dec/decode

Security vulnerability affects the tempo package. A buffer overflow vulnerability in the Brotli decoder c/dec/decode...

Oracle Linux 9 : nodejs:22 (ELSA-2026-96234)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-96234 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-195...

nodejs:22 security, bug fix, and enhancement update

nodejs 1:22.23.2-2.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds 1:22.23.2-2 - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496...

Security Bulletin: IBM QRadar SIEM contains Brotli components with known vulnerabilities

Summary A buffer overflow vulnerability in the Brotli decoder was addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-111497 DESCRIPTION: A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remo...

PT-2026-141616

I'm still doing it for work, so I figured I'll keep sharing them here! You might wanna grab a cup of coffee for this one because it's a long one. CVE-2026-111497 9.2: The HTTP2Shell also called Node2Shell CVE in the Brotli decoder. Reachable in Keycloak if the experimental feature http-client:v2 ...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses nodejs and packages which are vulnerable to CVE-2026-111497

Summary IBM Maximo Application Suite - Manage Component uses nodejs and packages which are vulnerable to CVE-2026-111497. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-111497 DESCRIPTION: A buffer overflow vulnerability in...

Security Bulletin: IBM Maximo Application Suite uses Nodejs 24 which is vulnerable to CVE-2026-111497

Summary IBM Maximo Application Suite uses Nodejs 24 which is vulnerable to CVE-2026-111497. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-111497 DESCRIPTION: A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection Component uses packages which are vulnerable to CVE-2026-111497

Summary IBM Maximo Application Suite - Visual Inspection Component uses packages which are vulnerable to CVE-2026-111497, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-111497 DESCRIPTION: A buffer overflow vulnerability in...

SUSE SLED15 / SLES15 Security Update : python-Brotli (SUSE-SU-2026:5125-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:5125-1 advisory. This update for python-Brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits...

macOS 27.x < 27.2.1 Multiple Vulnerabilities (149718)

The remote host is running a version of macOS / Mac OS X that is 27.x prior to 27.2.1. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote...

Oracle Linux 9 : nodejs:24 (ELSA-2026-96226)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-96226 advisory. - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory...

nodejs:24 security update

nodejs 1:24.21.0-1.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds 1:24.21.0-1 - Update to version 24.21.0 1:24.19.0-1 - Update to version 24.19.0...

macOS 26.x < 26.7.3 Multiple Vulnerabilities (149719)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.3. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote...

CLEANSTART-2026-PK34224 buffer overflow vulnerability in the Brotli decoder (c/dec/decode

Security vulnerability affects the apache-nifi package. A buffer overflow vulnerability in the Brotli decoder c/dec/decode...

Security update for python-Brotli

This update for python-Brotli fixes the following issue: CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287779. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:5125-1 Security update for python-Brotli

This update for python-Brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287779...