ZeroDayAlert

CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Google Brotli Added to KEV 2026-10-27 Federal due 2026-11-10 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Google Brotli is a compression library used across many software products and services. The vulnerability affects any system that decompresses Brotli-compressed streams, particularly where those streams originate from untrusted sources or reach the decoder over a network. The record does not specify which versions of Brotli are vulnerable or which products that bundle Brotli are affected; you will need to check your supply chain.

How to check whether this touches you

  • Audit your software inventory to identify all products and services that use Brotli, including those bundled as a dependency. Check your software bill of materials (SBOM) and dependency-tracking tools.
  • Determine whether each instance receives Brotli-compressed data from the internet or from untrusted local sources. If Brotli decompression is internal only or processes only data you control, exposure is lower.
  • Fingerprint the running or deployed version of Brotli in each product by querying package managers, build metadata, or the product's own version reporting. Note that vendors sometimes backport security fixes without changing the full version number.
  • If the product is a web browser, CDN client, or HTTP library, assume it handles compressed streams from the internet and treat it as exposed unless explicitly configured otherwise.

What to do

  1. Consult Google's advisory and your product vendors' security bulletins to identify which versions contain the fix and whether a patch is available for each product you use.
  2. If a patch is available, plan and schedule deployment according to CISA BOD 26-04 risk guidance, prioritising internet-facing or user-facing instances.
  3. Until a patch is deployed, reduce exposure by disabling Brotli decompression where possible, restricting the sources from which compressed streams are accepted, or running the decoder in a sandboxed environment.
  4. Enable logging of decompression errors and memory corruption signals (segmentation faults, access violations) on systems processing Brotli streams. Retain these logs for retrospective analysis.
  5. If no patch is available from your vendor, evaluate whether you can discontinue use of the affected product or replace it with an alternative.

If you find you were exposed

Brotli decompression vulnerabilities may be exploited passively; an attacker can deliver a malicious compressed stream and observe or exfiltrate the results without leaving obvious traces. Review access logs, network captures, and decompression error logs for the period before the vulnerability was disclosed, focusing on anomalous input or memory errors. Log retention is typically the limiting factor in this search, so prioritise the most recent 90 days of records and escalate to your incident response team if you find evidence of repeated decompression failures or memory corruption.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-111497 is being exploited. It cannot tell you whether Brotli is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →