# CVE-2026-111497: Out-of-Bounds Write in Google Brotli Decoder

Status: published. Published: 2026-10-22. Updated: 2026-11-04.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

## Remediation

- fix: Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (source: CNA: Google)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Google) — https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
- fix: brotli (PyPI): OSV reports a fixed version 1.2.1. Check the advisory for supported release branches. (source: OSV GHSA-9v8h-qqgm-4m35) — https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- fix: brotlicffi (PyPI): OSV reports a fixed version 1.2.1.0. Check the advisory for supported release branches. (source: OSV GHSA-9v8h-qqgm-4m35) — https://github.com/advisories/GHSA-9v8h-qqgm-4m35

## Affected products and versions

- Google / Brotli (github.com/google/brotli): ≥ 1.0.3; < 1.0.10 (affected, semver); ≥ 1.1.0; < 1.1.1 (affected, semver); ≥ 1.2.0; < 1.2.1 (affected, semver). Source: CNA: Google
- Siemens / Desigo CC family V8: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Desigo CC family V9: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Heliox Dual Port 60kW: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / Heliox Flex Pro: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / SICHARGE FLEX: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / SICHARGE UC: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / Sifinity Go: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / Sifinity Setup: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / VersiCharge AC Series: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / VersiCloud: ≥ 0; < * (unaffected, custom). Source: ADP: siemens-SADP
- Siemens / Cloud Connector Configurator: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Common Configurator (CC on IEM): ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Common Configurator on Device (CC on Edge): ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Data Flow Monitoring: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Databus Configurator: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Edge OPC UA Server Configurator: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Flow Creator Configurator: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Industrial Edge Hub: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / Industrial Edge Management Cloud: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM APE1808: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
-  / brotli (brotli): 1.0.4 (affected, PyPI); 1.0.6 (affected, PyPI); 1.0.7 (affected, PyPI); 1.0.8 (affected, PyPI); 1.0.9 (affected, PyPI); 1.1.0 (affected, PyPI); 1.2.0 (affected, PyPI); Ecosystem version events: introduced 1.0.3; fixed 1.2.1. Source: OSV GHSA-9v8h-qqgm-4m35
-  / brotlicffi (brotlicffi): 1.0.9.0 (affected, PyPI); 1.0.9.1 (affected, PyPI); 1.0.9.2 (affected, PyPI); 1.1.0.0 (affected, PyPI); 1.2.0.0 (affected, PyPI); 1.2.0.1 (affected, PyPI); 1.2.0.2 (affected, PyPI); Ecosystem version events: introduced 1.0.3; fixed 1.2.1.0. Source: OSV GHSA-9v8h-qqgm-4m35

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
            "versionEndExcluding": "1.0.10",
            "versionStartIncluding": "1.0.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
            "versionEndExcluding": "1.1.1",
            "versionStartIncluding": "1.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
            "versionEndExcluding": "1.2.1",
            "versionStartIncluding": "1.2.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "versionEndExcluding": "22.23.4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "versionEndExcluding": "24.22.1",
            "versionStartIncluding": "23.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "versionEndExcluding": "26.12.1",
            "versionStartIncluding": "25.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*",
            "versionEndExcluding": "1.2.1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "8.0.33",
            "versionStartIncluding": "8.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "9.0.22",
            "versionStartIncluding": "9.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "10.0.14",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.29.9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.30.6",
            "versionStartIncluding": "1.30.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.31.2",
            "versionStartIncluding": "1.31.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.4.4",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.37.8",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.38.6",
            "versionStartIncluding": "1.38.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.39.3",
            "versionStartIncluding": "1.39.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "202608",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "2.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "26.10.2.103",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "26.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "26.02-1.5.7-r2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "16.02",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*",
            "versionEndExcluding": "1.2.7",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: Google

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cve-coordination@google.com

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov

- CISA KEV: listed; Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; due 2026-11-10

- EPSS: 82.64% as of 2026-11-04; percentile 99.67%

- SSVC: exploitation active; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-787, CWE-252

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high (CNA: Google; patch)

- https://github.com/andybalholm/brotli/releases/tag/v1.2.7 (CNA: Google; release-notes, third-party-advisory)

- https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ (ADP: CISA-ADP; third-party-advisory)

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 (ADP: CISA-ADP; government-resource)

- https://github.com/advisories/GHSA-9v8h-qqgm-4m35 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/23/25 (ADP: CVE)

- https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/24/6 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/26/12 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/26/13 (ADP: CVE)

- https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 (ADP: CVE)

- https://broccoli2shell.com/ (ADP: CVE)

- https://github.com/dotnet/announcements/issues/494 (ADP: CVE)

- https://github.com/google/brotli/releases/tag/v1.2.1 (ADP: CVE)

- https://github.com/google/brotli/releases/tag/v1.1.1 (ADP: CVE)

- https://github.com/google/brotli/releases/tag/v1.0.10 (ADP: CVE)

- https://patchtheplanet.org/brotli (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/26/16 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/11/03/2 (ADP: CVE)

- https://cert-portal.siemens.com/productcert/html/ssa-898633.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-443410.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-045512.html (ADP: siemens-SADP)

- https://github.com/andybalholm/brotli/releases/tag/v1.2.7 (cve-coordination@google.com; Release Notes)

- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high (cve-coordination@google.com; Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/10/23/25 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/10/24/6 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/10/26/12 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/10/26/13 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/10/26/16 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2026/11/03/2 (af854a3a-2127-422b-91ae-364da2661108)

- https://broccoli2shell.com/ (af854a3a-2127-422b-91ae-364da2661108; Third Party Advisory)

- https://github.com/advisories/GHSA-9v8h-qqgm-4m35 (af854a3a-2127-422b-91ae-364da2661108; Third Party Advisory)

- https://github.com/dotnet/announcements/issues/494 (af854a3a-2127-422b-91ae-364da2661108; Issue Tracking, Mitigation, Third Party Advisory)

- https://github.com/google/brotli/releases/tag/v1.0.10 (af854a3a-2127-422b-91ae-364da2661108; Release Notes)

- https://github.com/google/brotli/releases/tag/v1.1.1 (af854a3a-2127-422b-91ae-364da2661108; Release Notes)

- https://github.com/google/brotli/releases/tag/v1.2.1 (af854a3a-2127-422b-91ae-364da2661108; Release Notes)

- https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- https://patchtheplanet.org/brotli (af854a3a-2127-422b-91ae-364da2661108; Third Party Advisory)

- https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 (af854a3a-2127-422b-91ae-364da2661108; Third Party Advisory)

- https://cert-portal.siemens.com/productcert/html/ssa-045512.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e; Third Party Advisory)

- https://cert-portal.siemens.com/productcert/html/ssa-443410.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e; Third Party Advisory)

- https://cert-portal.siemens.com/productcert/html/ssa-898633.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e; Third Party Advisory)

- https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ (134c704f-9b21-4f2e-91b3-4a467353bcc0; Third Party Advisory)

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 (134c704f-9b21-4f2e-91b3-4a467353bcc0; US Government Resource)

- https://github.com/advisories/GHSA-9v8h-qqgm-4m35 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: Google: https://www.cve.org/CVERecord?id=CVE-2026-111497; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497; retrieved 2026-11-04; source updated 2026-11-03

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35; retrieved 2026-11-03; source updated 2026-11-03

- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; retrieved 2026-11-02; source updated Not reported

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-111497; retrieved 2026-11-04; source updated Not reported

Revision: 5ac2c7ad61b432017acc0a8bc52b677b78f617d8a823625668cfb33c4374e106

Canonical: https://y2.dev/cve/CVE-2026-111497

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.