CVE catalog

CVE-2026-111497

Brotli vulnerability

[CVE catalog]

Severity
Critical · CVSS 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
55.48% · Oct 27, 2026

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbrotlisid1.2.0-4.1fixed
Debianbrotliforky1.2.0-4vulnerable
Debianbrotlitrixie1.1.0-2vulnerable
Debianbrotlitrixie-security1.1.0-2+deb13u1fixed
Debianbrotlibookworm1.0.9-2vulnerable
Debianbrotlibookworm-security1.0.9-2+deb12u1fixed
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1vulnerable
Debiannodejstrixie20.19.2+dfsg-1+deb13u2vulnerable
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3vulnerable
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2vulnerable
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3vulnerable
Alpinebrotli3.211.1.1-r0fixed
Alpinebrotli3.231.2.1-r0fixed
Alpinebrotli3.241.2.1-r0fixed
Ubuntunodejspro10.15.2~dfsg-2ubuntu1vulnerable
Ubuntunodejspro10.17.0~dfsg-2ubuntu4vulnerable
Ubuntunodejspro10.17.0~dfsg-2ubuntu6vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.1vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.2vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.3vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.5vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.6vulnerable
Ubuntunodejspro10.19.0~dfsg-3ubuntu1.6+esm2vulnerable
Ubuntubrotli22.041.0.9-2build3vulnerable
Ubuntubrotli22.041.0.9-2build4vulnerable
Ubuntubrotli22.041.0.9-2build5vulnerable
Ubuntubrotli22.041.0.9-2build6vulnerable
Ubuntubrotli22.041.0.9-2ubuntu0.1fixed
Ubuntubrotli24.041.0.9-2build8vulnerable
Ubuntubrotli24.041.1.0-1vulnerable
Ubuntubrotli24.041.1.0-2~build1vulnerable
Ubuntubrotli24.041.1.0-2vulnerable
Ubuntubrotli24.041.1.0-2build1vulnerable
Ubuntubrotli24.041.1.0-2build2vulnerable
Ubuntubrotli24.041.1.0-2ubuntu0.1fixed
Ubuntubrotli26.101.2.0-3build1vulnerable
Ubuntubrotli26.101.2.0-4vulnerable
Ubuntubrotli26.101.2.0-4ubuntu0.1fixed
Ubuntubrotli26.041.1.0-2build5vulnerable
Ubuntubrotli26.041.1.0-2build6vulnerable
Ubuntubrotli26.041.2.0-3vulnerable
Ubuntubrotli26.041.2.0-3build1vulnerable
Ubuntubrotli26.041.2.0-3ubuntu0.1fixed
Opensusebrotlitumbleweed1.2.1-1.1fixed
Ubuntubrotlinoble1.1.0-2ubuntu0.1fixed
Ubuntulibbrotli-devnoble1.1.0-2ubuntu0.1fixed
Ubuntulibbrotli1noble1.1.0-2ubuntu0.1fixed
Ubuntupython3-brotlinoble1.1.0-2ubuntu0.1fixed
Ubuntubrotli22.041.0.9-2build3vulnerable
Ubuntubrotli22.041.0.9-2build4vulnerable
Ubuntubrotli22.041.0.9-2build5vulnerable
Ubuntubrotli22.041.0.9-2build6vulnerable
Ubuntubrotli22.041.0.9-2ubuntu0.1fixed
Ubuntubrotli24.041.0.9-2build8vulnerable
Ubuntubrotli24.041.1.0-1vulnerable
Ubuntubrotli24.041.1.0-2~build1vulnerable
Ubuntubrotli24.041.1.0-2vulnerable
Ubuntubrotli24.041.1.0-2build1vulnerable
Ubuntubrotli24.041.1.0-2build2vulnerable
Ubuntubrotli24.041.1.0-2ubuntu0.1fixed
Ubuntubrotli26.101.2.0-3build1vulnerable
Ubuntubrotli26.101.2.0-4vulnerable
Ubuntubrotli26.101.2.0-4ubuntu0.1fixed
Ubuntubrotli26.041.1.0-2build5vulnerable
Ubuntubrotli26.041.1.0-2build6vulnerable
Ubuntubrotli26.041.2.0-3vulnerable
Ubuntubrotli26.041.2.0-3build1vulnerable
Ubuntubrotli26.041.2.0-3ubuntu0.1fixed
Ubuntubrotlipro1.0.7-2vulnerable
Ubuntubrotlipro1.0.7-2build1vulnerable
Ubuntubrotlipro1.0.7-4vulnerable
Ubuntubrotlipro1.0.7-5vulnerable
Ubuntubrotlipro1.0.7-6vulnerable
Ubuntubrotlipro1.0.7-6build1vulnerable
Ubuntubrotlipro1.0.7-6ubuntu0.1vulnerable
Ubuntubrotlipro1.0.7-6ubuntu0.1+esm1fixed
Opensusepython-Brotlitumbleweed1.2.1-1.1fixed
CpebrotliNot reported1.2.1fixed
Cpenode.jsNot reported26.12.1fixed
CpebrotlicffiNot reported1.2.1.0fixed
Cpe.netNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbrotlisourcesid1.2.0-4.1not yet assignedNot reported[1151690]
Debianbrotlisourceforky(unfixed)not yet assignedNot reported[1151690]
Debianbrotlisourcetrixie1.1.0-2+deb13u1not yet assignedNot reported[1151690]
Debianbrotlisourcebookworm1.0.9-2+deb12u1not yet assignedNot reported[1151690]
Debiannodejssourcesid24.22.1+dfsg+~cs24.19.2-1unimportantNot reportedNot reported
Debiannodejssourceforky(unfixed)unimportantNot reportedNot reported
Debiannodejssourcetrixie(unfixed)unimportantNot reportedNot reported
Debiannodejssourcebookworm(unfixed)unimportantNot reportedNot reported
Alpinebrotliapk3.211.1.1-r0Not reportedALPINE-CVE-2026-111497Not reported
Alpinebrotliapk3.231.2.1-r0Not reportedALPINE-CVE-2026-111497Not reported
Alpinebrotliapk3.241.2.1-r0Not reportedALPINE-CVE-2026-111497Not reported
Ubuntubrotlideb22.041.0.9-2ubuntu0.1Not reportedUBUNTU-CVE-2026-111497Not reported
Ubuntubrotlideb24.041.1.0-2ubuntu0.1Not reportedUBUNTU-CVE-2026-111497Not reported
Ubuntubrotlideb26.101.2.0-4ubuntu0.1Not reportedUBUNTU-CVE-2026-111497Not reported
Ubuntubrotlideb26.041.2.0-3ubuntu0.1Not reportedUBUNTU-CVE-2026-111497Not reported
Opensusebrotlirpmtumbleweed1.2.1-1.1Not reportedOPENSUSE-SU-2026:12232-1Not reported
Ubuntubrotlidebnoble1.1.0-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibbrotli-devdebnoble1.1.0-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibbrotli1debnoble1.1.0-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntupython3-brotlidebnoble1.1.0-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntubrotlideb22.041.0.9-2ubuntu0.1Not reportedUSN-8956-1Not reported
Ubuntubrotlideb24.041.1.0-2ubuntu0.1Not reportedUSN-8956-1Not reported
Ubuntubrotlideb26.101.2.0-4ubuntu0.1Not reportedUSN-8956-1Not reported
Ubuntubrotlideb26.041.2.0-3ubuntu0.1Not reportedUSN-8956-1Not reported
Ubuntubrotlidebpro1.0.7-6ubuntu0.1+esm1Not reportedUBUNTU-CVE-2026-111497Not reported
Opensusepython-Brotlirpmtumbleweed1.2.1-1.1Not reportedOPENSUSE-SU-2026:12305-1Not reported
CpebrotlicpeNot reported1.2.1Not reportedNVD-CVE-2026-111497Not reported
Cpenode.jscpeNot reported26.12.1Not reportedNVD-CVE-2026-111497Not reported
CpebrotlicfficpeNot reported1.2.1.0Not reportedNVD-CVE-2026-111497Not reported

[Debian bug #1151690]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [brotli]Affected

    Source package: [brotli]

    Details (2)

    • 1.0.9-2+b6 · amd64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

    • 1.0.9-2+b6 · arm64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

  • [libbrotli1]Affected

    Source package: [brotli]

    Details (2)

    • 1.0.9-2+b6 · amd64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

    • 1.0.9-2+b6 · arm64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

  • [libbrotli-dev]Affected

    Source package: [brotli]

    Details (2)

    • 1.0.9-2+b6 · amd64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

    • 1.0.9-2+b6 · arm64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

  • [libnode108]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

  • [nodejs]Affected
    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      usn · nodejs · debian · bookworm; usn · nodejs · debian · 12

  • [python3-brotli]Affected

    Source package: [brotli]

    Details (2)

    • 1.0.9-2+b6 · amd64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

    • 1.0.9-2+b6 · arm64 · bookworm

      Affected · Fixed: 1.0.9-2+deb12u1

      usn · brotli · debian · bookworm; usn · brotli · debian · 12

[Debian 13 (Trixie)]

  • [brotli]Affected
    Details (3)

    • 1.1.0-2+b7 · amd64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+b7 · arm64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

  • [libbrotli1]Affected

    Source package: [brotli]

    Details (3)

    • 1.1.0-2+b7 · amd64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+b7 · arm64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

  • [libbrotli-dev]Affected

    Source package: [brotli]

    Details (3)

    • 1.1.0-2+b7 · amd64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+b7 · arm64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

  • [libnode115]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      usn · nodejs · debian · 13

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      usn · nodejs · debian · 13

  • [nodejs]Affected
    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      usn · nodejs · debian · 13

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security · Historical version

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security

      Affected

      usn · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · all · trixie-security

      Affected

      usn · nodejs · debian · 13

  • [python3-brotli]Affected

    Source package: [brotli]

    Details (3)

    • 1.1.0-2+b7 · amd64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+b7 · arm64 · trixie

      Affected · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

    • 1.1.0-2+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0-2+deb13u1

      usn · brotli · debian · 13

  • [python3-brotlicffi]Affected

    Source package: [python-brotlicffi]

    Details (2)

    • 1.1.0.0+ds1-1 · amd64 · trixie

      Affected

      usn · python-brotlicffi · debian · 13

    • 1.1.0.0+ds1-1+b1 · arm64 · trixie

      Affected

      usn · python-brotlicffi · debian · 13

[openSUSE Tumbleweed]

  • [brotli]Affected

    Source package: [brotli]

    Details (1)

    • 1.2.0-2.4 · x86_64 · tumbleweed

      Affected · Fixed: 1.2.1-1.1

      usn · brotli · opensuse · tumbleweed

  • [libbrotlicommon1]Unknown

    Source package: [brotli]

    Details (1)

    • 1.2.0-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.1-1.1

      Version impact unknown

      usn · brotli · opensuse · tumbleweed

  • [libbrotlicommon1-32bit]Unknown

    Source package: [brotli]

    Details (1)

    • 1.2.0-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.1-1.1

      Version impact unknown

      usn · brotli · opensuse · tumbleweed

Next results

Observed:

References

[CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]