All vulnerabilities
CVE-2026-111497GHSA-9v8h-qqgm-4m35

Out-of-Bounds Write in Google Brotli Decoder

Google BrotliPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.10Also 1.1.1, 1.2.1 and 1 moreCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1.0.10BrotliCVE List
  • 1.1.1BrotliCVE List
  • 1.2.1BrotliCVE List
  • 1.2.1brotli, PyPIOSVpip install "brotli>=1.2.1"
  • 1.2.1.0brotlicffi, PyPIOSVpip install "brotlicffi>=1.2.1.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 Oct 2026, 04:08 UTCExploit code publicGitHub proof-of-concept repositories
  2. 22 Oct 2026, 13:35 UTCPublishedCVE List

Reports 15

4 outlets mention it. Reports are not confirmation; each links to its source.

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Text from CVE List

Affected versions 19

  • Brotliaffected: 1.0.3 before 1.0.10CVE List
  • Brotliaffected: 1.1.0 before 1.1.1CVE List
  • Brotliaffected: 1.2.0 before 1.2.1CVE List
  • brotli, PyPIfrom 1.0.3, fixed in 1.2.1OSV
  • brotli, PyPI1.0.4OSV
  • brotli, PyPI1.0.6OSV
  • brotli, PyPI1.0.7OSV
  • brotli, PyPI1.0.8OSV
  • brotli, PyPI1.0.9OSV
  • brotli, PyPI1.1.0OSV
  • brotli, PyPI1.2.0OSV
  • brotlicffi, PyPIfrom 1.0.3, fixed in 1.2.1.0OSV
  • brotlicffi, PyPI1.0.9.0OSV
  • brotlicffi, PyPI1.0.9.1OSV
  • brotlicffi, PyPI1.0.9.2OSV
  • brotlicffi, PyPI1.1.0.0OSV
  • brotlicffi, PyPI1.2.0.0OSV
  • brotlicffi, PyPI1.2.0.1OSV
  • brotlicffi, PyPI1.2.0.2OSV

References 3