Summary
- CVE-2026-111497 affects Brotli decompression and has been added to CISA’s KEV catalogue.
- The vulnerable library appears within multiple application and infrastructure ecosystems.
- Observed probing is not proof that every exploit attempt succeeded or that every dependent product is affected.
The US Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in the Brotli decompression library to its Known Exploited Vulnerabilities catalogue, following reports of attempts to attack systems that process specially crafted compressed data. The flaw, CVE-2026-111497, is an out-of-bounds write that could cause process crashes, memory disclosure or potentially arbitrary code execution in affected applications.
Brotli is a compression technology used to reduce the amount of data transferred or stored by software systems. Its presence in common application frameworks and infrastructure components means a vulnerable decoder may be embedded in products whose administrators never installed Brotli as a standalone package. The exposure depends on whether a particular product includes an affected version and whether untrusted compressed input can reach the vulnerable code path.
CISA added the CVE to its exploited-vulnerability catalogue on 27 October and set a remediation deadline of 10 November for covered US federal civilian agencies. That designation records a government determination that exploitation is occurring; it does not identify every targeted organisation or establish that each observed attempt achieved code execution. It is relevant to European operators because the underlying library and affected software are distributed internationally.
The Canadian Centre for Cyber Security identifies Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python Brotli packages among technologies requiring assessment. These are not automatically equally vulnerable in every supported version. Some maintainers have provided fixed builds, while downstream vendors may bundle the library differently or require separate application-level updates. Inventorying the versions actually deployed is therefore more precise than assuming a single operating-system patch addresses the problem.
Compression libraries sit below the layer where many application developers expect to examine security threats. A service can accept a request, hand a compressed body to a library and fail before the application’s own validation logic sees the expanded content. That makes reachable decoder code an important condition in evaluating risk. The same library may also be packaged statically within a binary, which can complicate software inventories based only on system-wide package managers. Products that use Brotli solely in a context inaccessible to untrusted data have a different risk profile from publicly exposed decoders.
The Canadian cyber authority’s advisory identifies fixed upstream Brotli ranges, including 1.0.10, 1.1.1 and 1.2.1 for their respective vulnerable branches. Those library versions can guide technical investigation, but each downstream product may require a separate supported release. Applying an upstream fix to a development environment does not prove that a packaged production binary has been rebuilt or redistributed with the corrected decoder.
CISA’s listing and independent attack telemetry concern exploitation activity, while the number of production systems successfully compromised remains unknown. An out-of-bounds write can be severe without guaranteeing code execution on every platform or build, and unreliable payloads can still cause service disruption. Defenders also need to account for fixes in language runtimes, reverse proxies and management appliances rather than wait for one upstream library release to propagate automatically. CISA’s exploited designation and the independent honeypot observations support prompt assessment while leaving open which affected products have been exploited successfully in operational environments.
Sensor operators have reported malicious attempts against decoy services. Investigators at ELLIO identified an attack request that resembled public proof-of-concept material, but found that the attacker’s final stage failed to obtain a shell in repeated tests. An unsuccessful attempt can still be relevant because malformed compressed input may crash a vulnerable application. Separately, controlled security demonstrations of code execution do not prove that identical exploitation has been achieved in customer production environments.
Broadcom has also warned that affected VMware management components may include the vulnerable dependency, with remediation paths varying by release. Fixes for the underlying decoder may reach VMware management products, application runtimes and other downstream packages on different schedules. Administrators must use the applicable vendor’s fixed build or dependency guidance, rather than assume updating one shared system library resolves every embedded copy.
