Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Brotli compression library can be crashed or hijacked
published 6 days ago
Summary
Versions 1.0.3 through 1.2.0 of the Brotli library can be tricked into overflowing a memory buffer when processing a crafted compressed file. This could let an attacker read private data, crash the application, or run their own code. Upgrade any Brotli components to the newest release (1.0.10, 1.1.1 or 1.2.1) as soon as possible.
What to do
- Update openeuler brotli to version 1.1.1-1.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | brotli |
< 1.1.1-1.oe2403sp3 Fix: upgrade to 1.1.1-1.oe2403sp3
|
Original advisory text
brotli security update
Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.
Security Fix(es):
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)
Security Fix(es):
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111497 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published29 Oct 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
OESA-2026-4542 · OSV
Track software like this
Free during beta