Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

T1High 40Covered by 1 source · first reported by Tenable Research at 27 Oct, 01:19 UTC

Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for…