A critical bug in the widely used Brotli compression library has forced security updates across Microsoft products, Node.js, and Python packages. The flaw, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder affecting Brotli 1.0.3 through 1.2.0 and fixed in 1.0.10, 1.1.1, and 1.2.1. Microsoft patched .NET runtimes 8.0.33, 9.0.22, 10.0.14, .NET 11 RC3, Visual Studio 2019/2022/2026, and PowerShell 7.4/7.5/7.6; Node.js and the PyPI packages Brotli and brotlicffi were also updated. Specially crafted compressed input can trigger memory corruption and potentially remote code execution when attacker-controlled Brotli data is decoded.
Ionut Arghire
2026.11.05
71% relevant
It adds vendor impact information to the same Brotli vulnerability story, saying Cisco now lists 19 affected products and is still assessing dozens more, while nearly a dozen Splunk products are also affected.
Sergiu Gatlan
2026.10.28
95% relevant
This updates the same underlying Brotli vulnerability event by adding that CISA has confirmed active exploitation, added CVE-2026-111497 to the KEV catalog, and ordered federal agencies to patch by November 10, with mitigation guidance to block Brotli-compressed requests or disable Brotli decoding if patching is delayed.
Eduard Kovacs
2026.10.28
93% relevant
This advances the same underlying Brotli/Node2Shell event by adding CISA KEV inclusion, observed honeypot exploitation attempts on October 26-27, and new impact information for Broadcom VMware SDDC Manager with workarounds but no patches yet.
2026.10.26
93% relevant
This article adds that Microsoft has now released out-of-band .NET security updates for .NET 8, 9, 10, and 11, confirms Microsoft's severity and exploitability assessment for CVE-2026-111497, and situates the fixes within the broader cross-ecosystem patching effort already tied to the same Brotli vulnerability.
info@thehackernews.com (The Hacker News)
2026.10.26
91% relevant
This article adds that PHP has issued a second Windows security update within five days to address the same Brotli code-execution flaw, expanding the list of affected ecosystems and underscoring patch urgency for PHP on Windows.
Bill Toulas
2026.10.26
96% relevant
This article is a direct update on the same Brotli vulnerability event, adding the 'HTTP2Shell' naming, technical exploit details for the buffer overflow, specific patched versions for Google Brotli, Node.js, and Python packages, and noting that PoC exploits are public while no in-the-wild exploitation has been reported.
Sergiu Gatlan
2026.10.26
96% relevant
This article adds that Microsoft has now issued out-of-band .NET fixes for CVE-2026-111497, including specific patched versions for .NET 8, 9, 10, and .NET 11 RC3, plus mitigation guidance for apps using Brotli decompression.
Eduard Kovacs
2026.10.26
100% relevant
This article establishes a new cross-ecosystem vulnerability story centered on CVE-2026-111497 in Google's Brotli decoder and the resulting coordinated patches across multiple major software platforms.