{"affected":[{"defaultStatus":"unaffected","packageName":"github.com/google/brotli","product":"Brotli","source":"CNA: Google","vendor":"Google","versions":[{"lessThan":"1.0.10","status":"affected","version":"1.0.3","versionType":"semver"},{"lessThan":"1.1.1","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThan":"1.2.1","status":"affected","version":"1.2.0","versionType":"semver"}]},{"defaultStatus":"unknown","product":"Desigo CC family V8","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Desigo CC family V9","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Heliox Dual Port 60kW","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Heliox Flex Pro","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SICHARGE FLEX","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SICHARGE UC","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Sifinity Go","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Sifinity Setup","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"VersiCharge AC Series","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"VersiCloud","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Cloud Connector Configurator","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Common Configurator (CC on IEM)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Common Configurator on Device (CC on Edge)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Data Flow Monitoring","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Databus Configurator","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Edge OPC UA Server Configurator","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Flow Creator Configurator","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Hub","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Cloud","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM APE1808","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"brotli","product":"brotli","source":"OSV GHSA-9v8h-qqgm-4m35","vendor":"","versions":[{"status":"affected","version":"1.0.4","versionType":"PyPI"},{"status":"affected","version":"1.0.6","versionType":"PyPI"},{"status":"affected","version":"1.0.7","versionType":"PyPI"},{"status":"affected","version":"1.0.8","versionType":"PyPI"},{"status":"affected","version":"1.0.9","versionType":"PyPI"},{"status":"affected","version":"1.1.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0","versionType":"PyPI"},{"events":[{"introduced":"1.0.3"},{"fixed":"1.2.1"}],"status":"unknown","version":"1.0.3","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"brotlicffi","product":"brotlicffi","source":"OSV GHSA-9v8h-qqgm-4m35","vendor":"","versions":[{"status":"affected","version":"1.0.9.0","versionType":"PyPI"},{"status":"affected","version":"1.0.9.1","versionType":"PyPI"},{"status":"affected","version":"1.0.9.2","versionType":"PyPI"},{"status":"affected","version":"1.1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0.1","versionType":"PyPI"},{"status":"affected","version":"1.2.0.2","versionType":"PyPI"},{"events":[{"introduced":"1.0.3"},{"fixed":"1.2.1.0"}],"status":"unknown","version":"1.0.3","versionType":"ECOSYSTEM"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*","versionEndExcluding":"1.0.10","versionStartIncluding":"1.0.3","vulnerable":true},{"criteria":"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*","versionEndExcluding":"1.1.1","versionStartIncluding":"1.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*","versionEndExcluding":"1.2.1","versionStartIncluding":"1.2.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionEndExcluding":"22.23.4","vulnerable":true},{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionEndExcluding":"24.22.1","versionStartIncluding":"23.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionEndExcluding":"26.12.1","versionStartIncluding":"25.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*","versionEndExcluding":"1.2.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.33","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.22","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*","versionEndExcluding":"1.29.9","vulnerable":true},{"criteria":"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*","versionEndExcluding":"1.30.6","versionStartIncluding":"1.30.0","vulnerable":true},{"criteria":"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*","versionEndExcluding":"1.31.2","versionStartIncluding":"1.31.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","versionEndExcluding":"1.37.8","vulnerable":true},{"criteria":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","versionEndExcluding":"1.38.6","versionStartIncluding":"1.38.0","vulnerable":true},{"criteria":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","versionEndExcluding":"1.39.3","versionStartIncluding":"1.39.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*","versionEndIncluding":"202608","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*","versionEndIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*","versionEndIncluding":"26.10.2.103","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*","versionEndIncluding":"26.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*","versionEndIncluding":"26.02-1.5.7-r2","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*","versionEndIncluding":"16.02","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*","versionEndExcluding":"1.2.7","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-111497","cwes":["CWE-787","CWE-252"],"description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","epss":{"date":"2026-11-04","percentile":0.99668,"score":0.82641},"exploits":[],"kev":{"addedAt":1793059200000,"dueDateAt":1794268800000,"knownRansomwareUse":false,"product":"Brotli","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","vendor":"Google","vulnerabilityName":"Google Brotli Unchecked Return Value Vulnerability"},"metrics":[{"score":9.2,"severity":"critical","source":"CNA: Google","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":9.2,"severity":"critical","source":"NVD: cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":9.8,"severity":"critical","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793814462136,"publishedAt":1792676141975,"references":[{"source":"CNA: Google","tags":["patch"],"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"CNA: Google","tags":["release-notes","third-party-advisory"],"url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7"},{"source":"ADP: CISA-ADP","tags":["third-party-advisory"],"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"},{"source":"ADP: CISA-ADP","tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13"},{"source":"ADP: CVE","tags":[],"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"},{"source":"ADP: CVE","tags":[],"url":"https://broccoli2shell.com/"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/dotnet/announcements/issues/494"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/google/brotli/releases/tag/v1.1.1"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/google/brotli/releases/tag/v1.0.10"},{"source":"ADP: CVE","tags":[],"url":"https://patchtheplanet.org/brotli"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/16"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/03/2"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-898633.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-443410.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-045512.html"},{"source":"cve-coordination@google.com","tags":["Release Notes"],"url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7"},{"source":"cve-coordination@google.com","tags":["Third Party Advisory"],"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/26/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/03/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://broccoli2shell.com/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mitigation","Third Party Advisory"],"url":"https://github.com/dotnet/announcements/issues/494"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://github.com/google/brotli/releases/tag/v1.0.10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://github.com/google/brotli/releases/tag/v1.1.1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://patchtheplanet.org/brotli"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-045512.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-443410.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-898633.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"],"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"}],"remediation":[{"kind":"fix","source":"CNA: Google","text":"Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."},{"kind":"fix","source":"CNA: Google","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"kind":"fix","source":"OSV GHSA-9v8h-qqgm-4m35","text":"brotli (PyPI): OSV reports a fixed version 1.2.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"kind":"fix","source":"OSV GHSA-9v8h-qqgm-4m35","text":"brotlicffi (PyPI): OSV reports a fixed version 1.2.1.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"}],"revision":"5ac2c7ad61b432017acc0a8bc52b677b78f617d8a823625668cfb33c4374e106","sources":[{"modifiedAt":1793814462136,"name":"CNA: Google","retrievedAt":1793815794435,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"modifiedAt":1793744264223,"name":"NVD","retrievedAt":1793751568645,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"modifiedAt":1793726103998,"name":"OSV / GitHub Security Advisories","retrievedAt":1793747315385,"url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"},{"modifiedAt":null,"name":"CISA KEV","retrievedAt":1793593224301,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793815812773,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111497"}],"ssvc":{"assessedAt":1792713600000,"automatable":"no","exploitation":"active","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Out-of-Bounds Write in Google Brotli Decoder","updatedAt":1793815812773}