Oct 26, 2026
securityhttp
CVE-2026-111497: Brotli HTTP Decompression Bug Risks RCE
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. It can expose services and clients that decompress attacker-controlled HTTP data to crashes, memory disclosure, or potentially code execution. Node.js, Bun, Envoy, Istio, and .NET have issued fixes, with exposure depending on how each application uses Brotli.
Read article