A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
{
"cna_assigner": "Google",
"cwe_ids": [
"CWE-252",
"CWE-787"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111497.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"original_tag": "v1.2.7",
"range": [
{
"fixed": "33c2a9884269798192b5ecf171288f98939dbe42"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "26.0.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*",
"range": [
{
"introduced": "27.0.0-dev"
},
{
"last_affected": "27.0.0-dev"
}
],
"source": "CPE_STRING"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "26.10.2.103"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-rc2"
},
{
"last_affected": "11.0.0-rc2"
}
],
"source": "CPE_STRING"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.0.0"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.37.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.38.0"
},
{
"fixed": "1.38.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.39.0"
},
{
"fixed": "1.39.3"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
"range": [
{
"introduced": "1.0.3"
},
{
"fixed": "1.0.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
"range": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*",
"range": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.2.1"
}
],
"source": "CPE_RANGE"
},
{
"original_tag": "v1.0.10",
"range": [
{
"fixed": "3646606894cd8b8c75d79a569b6c95a33c699d63"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v1.1.1",
"range": [
{
"fixed": "db0631dfea829194206d269bc7b25d0908cdb97d"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v1.2.1",
"range": [
{
"fixed": "db24a98aed38a16de78cc05ca15cdd8dc2a0d92d"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.29.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.30.0"
},
{
"fixed": "1.30.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.31.0"
},
{
"fixed": "1.31.2"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "26.02-1.5.7-r2"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "22.23.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "23.0.0"
},
{
"fixed": "24.22.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "25.0.0"
},
{
"fixed": "26.12.1"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.4.4"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "202608"
}
],
"source": "CPE_RANGE"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111497.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"251973990452172617341338522719012278798",
"253714937042129432078088413378048253319",
"104610891378844644553926847226100227842",
"275626855891961612016457576217552225188",
"176835295028746580510428291367763133099",
"114213354230969334069881648367075193712",
"265478228948461827005678962602652882747",
"213545665699451353156057373319656997720",
"31611074966593107830559886365131495382",
"30915074304289734442715807485113421437",
"125154847297754275230036449812574541558",
"89893190159820531069107218024350470638",
"204884617370262712179767125864516755674",
"188919223703619274055136649735933041805",
"113134846605056020058430558537954571690",
"102013723732105414194253735882361304888",
"56771049656946808068604765019712287264",
"147629271140355810375132691654172410859",
"38528452274375015043183963111660049958",
"90267277098892705312910001530658524005",
"317276807345208980091612480203279688012",
"4568904446189394596940796229089459910",
"70717422392574703324073615079541298",
"204586090918339620817216396550597902719",
"64244439659900800615647565975046320633",
"234696853973945658518163470992410533314",
"251618281342849465447134558773665367129",
"164929301934136480210130800248368172551",
"148418076694504207815304765713967049739",
"22810437729053347654255842373100636615",
"267069166346971974890981442719737423681",
"289027149214026946048747888800548077686",
"280540064168164167582582764376604530010",
"243048522660494239458240155112580417250",
"283540494093110265738787467426446704356",
"5364645330334796695761491686119929726",
"312812533530518058640811928673354303635",
"187964705454243511277571033593670185095",
"149408852594520259248517133333709970388",
"267203822309476449618059108756888846141",
"126182619404567184817310241216279299099",
"316050939289913795188968814796934756336",
"47631446081063721694393673628398765626",
"161678258122865439693777514992605915148",
"145277966838469796172055766549432823972",
"337148975058344020089110325996269546535",
"334544632462998958590580301993272123258",
"101234346187022217757923859696387308183",
"33784490441332778948388131241022376988",
"273522890964839130051197590426373730154",
"108177438921062140051830004256116207077",
"19086031593471144886071178471093761680",
"207620504114063029795770934279500472636",
"77509371880913247847172397170385875040",
"242518000220467030323992078651934220627",
"228288398916419401529485648516817680903",
"190383502006053312847399219743320387136"
],
"threshold": 0.9
},
"id": "CVE-2026-111497-196925d8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/oven-sh/bun/commit/38afee6c84fcf48c0edb2466aa4b27d287a59c30",
"target": {
"file": "packages/bun-uws/src/HttpParser.h"
}
}
]
"2026-11-12T07:07:33Z"