Exploit for Unchecked Return Value in Google Brotli

CVE-2026-111497: pinned WordPress image RCE PoC This source-o...

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

GHSA-PJH6-C8MG-3X7M Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

EUVD-2026-110320

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked incomplete fix of GHSA-hxp9-w8x3-p566...

checkmk_broccoli2shell

checkmkbroccoli2shell A Checkmk extension that shows, for every Brotli decoder on a Linux host, whether it is affected by Broccoli2Shell - CVE-2026-111497 , an out-of-bounds write in Google's C Brotli decoder that can lead to remote code execution when a program decompresses Brotli data from an...

Exploit for CVE-2026-111497

Node2Shell / Broccoli2Shell CVE-2026-111497 – Enterprise Ven...

Exploit for CVE-2026-111497

CVE-2026-111497 — Brotli decoder out-of-bounds write tracking...

Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run...

VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)

Advisory ID: | VMSA-2026-0008 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 7.5-9.8 Synopsis: | Node.js Brotli decoder out-of-bounds write remote code execution vulnerability CVE-2026-111497 Issue date: | 2026-10-27 Updated on: | 2026-10-27 Initial Advisory CVEs | CVE-2026-111497 1...

PT-2026-128065

Hundreds of Adobe Commerce and Magento stores are being breached via a chain exploiting two newly KEV-listed vulnerabilities. CISA added both to its catalog on Tuesday citing active exploitation, with one flaw carrying a CVSS 9.2. Technical Breakdown - CVE-2026-111497 CVSS 9.2: Unchecked return...

USN-8956-2 brotli vulnerability

USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this...

USN-8956-2: Brotli vulnerability

USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this...

Exploit for CVE-2026-111497

brotli-pingback-lab A small Docker lab for CVE-2026-111497...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

Exploit for CVE-2026-111497

brotli-k8s-scan !testshttps://github.com/depuschm/brotli-...

GHSA-H2V8-394M-P7VV Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Summary The built-in but disabled by default Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable...

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Summary The built-in but disabled by default Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable...

Microsoft Issues Emergency .NET Fixes for Brotli Flaw and Linux Privilege Escalation

Microsoft releases emergency .NET updates to fix a Brotli memory flaw and Linux privilege escalation, while correcting two incomplete October security patches...

The web’s having a rough week. Here’s how to browse safely

You recognize the website. You’ve visited it before. You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. Stop and check first. A website you trust can still display instructions you shouldn’t...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value...