DEBIAN-CVE-2026-111497

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-111497
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-111497
Upstream
Published
2026-10-22T14:17:37Z
Modified
2026-11-11T09:47:34Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

References

Affected packages

Debian:12
brotli

Package

Name
brotli
Purl
pkg:deb/debian/brotli?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.9-2+deb12u1

Affected versions

1.*
1.0.9-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
edk2

Package

Name
edk2
Purl
pkg:deb/debian/edk2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2022.*
2022.11-6
2022.11-6+deb12u1
2022.11-6+deb12u2
2023.*
2023.02-1
2023.02-2
2023.05-1
2023.05-2
2023.08-1
2023.11-1
2023.11-2
2023.11-3
2023.11-4
2023.11-5
2023.11-6
2023.11-7
2023.11-8
2024.*
2024.02-1
2024.02-2
2024.05-1
2024.05-2
2024.08-1
2024.08-2
2024.08-3
2024.08-4
2024.11-1
2024.11-2
2024.11-3
2024.11-4
2024.11-5
2025.*
2025.02-1
2025.02-2
2025.02-3
2025.02-4
2025.02-5
2025.02-6
2025.02-7
2025.02-8
2025.02-9
2025.02-10
2025.05-1
2025.05-2
2025.08.01-1
2025.08.01-2
2025.08.01-3
2025.08.01-4
2025.08.01-5
2025.08.01-6
2025.11-1
2025.11-2
2025.11-3
2025.11-4
2025.11-5
2026.*
2026.02-1
2026.02-2
2026.02-3
2026.05-1
2026.05-2
2026.05-3
2026.08+ds-1
2026.08+ds-2
2026.08+ds-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

18.*
18.13.0+dfsg1-1
18.13.0+dfsg1-1.1
18.19.0+dfsg-1
18.19.0+dfsg-2
18.19.0+dfsg-3
18.19.0+dfsg-4
18.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
18.19.0+dfsg-6~deb12u2
18.19.0+dfsg-6
18.19.1+dfsg-1
18.19.1+dfsg-2
18.19.1+dfsg-3
18.19.1+dfsg-3.1
18.19.1+dfsg-4
18.19.1+dfsg-6
18.20.1+dfsg-1
18.20.1+dfsg-2
18.20.1+dfsg-3
18.20.1+dfsg-4
18.20.4+dfsg-1~deb12u1
18.20.4+dfsg-1~deb12u2
18.20.4+dfsg-1~deb12u3
20.*
20.10.0+dfsg-1
20.12.2+dfsg-1
20.13.0+dfsg-1
20.13.1+dfsg-1
20.13.1+dfsg-2
20.14.0+dfsg-1
20.14.0+dfsg-2
20.14.0+dfsg-3
20.15.0+dfsg-1
20.15.1+dfsg-1
20.16.0+dfsg-1
20.17.0+dfsg-1
20.17.0+dfsg-2
20.18.0+dfsg-1
20.18.0+dfsg-2
20.18.1+dfsg-1
20.18.1+dfsg-2
20.18.2+dfsg-1
20.18.2+dfsg-2
20.18.2+dfsg-3
20.18.2+dfsg-4
20.18.3+dfsg-1
20.19.0+dfsg-1
20.19.0+dfsg-2
20.19.0+dfsg1-1
20.19.2+dfsg-1
20.19.4+dfsg-1
20.19.5+dfsg+~cs20.19.12-1
20.19.5+dfsg+~cs20.19.12-2
20.19.5+dfsg+~cs20.19.12-3
20.19.5+dfsg+~cs20.19.12-4
20.19.5+dfsg+~cs20.19.24-1
22.*
22.12.0+dfsg-1
22.12.0+dfsg-2
22.12.0+dfsg-3
22.14.0+dfsg-1
22.18.0+dfsg-1
22.18.0+dfsg+~cs22.17.2-1
22.18.0+dfsg+~cs22.17.2-2
22.19.0+dfsg+~cs22.18.0-1
22.21.1+dfsg+~cs22.19.0-1
22.21.1+dfsg+~cs22.19.0-2
22.21.1+dfsg+~cs22.19.0-3
22.21.1+dfsg+~cs22.19.0-4
22.21.1+dfsg+~cs22.19.0-5
22.21.1+dfsg+~cs22.19.0-6
22.22.0+dfsg+~cs22.19.6-1
22.22.0+dfsg+~cs22.19.13-1
22.22.0+dfsg+~cs22.19.13-2
22.22.1+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-3
24.*
24.11.1+dfsg+~cs24.10.1-1
24.11.1+dfsg+~cs24.10.1-2
24.12.0+dfsg+~cs24.10.4-1
24.13.0+dfsg+~cs24.10.7-1
24.13.0+dfsg+~cs24.10.7-2
24.14.0+dfsg+~cs24.12.0-1
24.14.0+dfsg+~cs24.12.0-2
24.14.1+dfsg+~cs24.12.0-1
24.15.0+dfsg+~cs24.12.2-1
24.16.0+dfsg+~cs24.13.1-1
24.16.0+dfsg+~cs24.13.1-2
24.17.0+dfsg+~cs24.13.2-1
24.18.0+dfsg+~cs24.13.2-1
24.19.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-2
24.21.0+dfsg+~cs24.13.4-1
24.22.0+dfsg+~cs24.19.2-1
24.22.0+dfsg+~cs24.19.2-2
24.22.1+dfsg+~cs24.19.2-1
24.22.2+dfsg+~cs24.19.2-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
Debian:13
brotli

Package

Name
brotli
Purl
pkg:deb/debian/brotli?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1.0-2+deb13u1

Affected versions

1.*
1.1.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
edk2

Package

Name
edk2
Purl
pkg:deb/debian/edk2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.02-8
2025.02-8+deb13u1
2025.02-9
2025.02-10
2025.05-1
2025.05-2
2025.08.01-1
2025.08.01-2
2025.08.01-3
2025.08.01-4
2025.08.01-5
2025.08.01-6
2025.11-1
2025.11-2
2025.11-3
2025.11-4
2025.11-5
2026.*
2026.02-1
2026.02-2
2026.02-3
2026.05-1
2026.05-2
2026.05-3
2026.08+ds-1
2026.08+ds-2
2026.08+ds-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.19.2+dfsg-1
20.19.2+dfsg-1+deb13u1
20.19.2+dfsg-1+deb13u2
20.19.2+dfsg-1+deb13u3
20.19.4+dfsg-1
20.19.5+dfsg+~cs20.19.12-1
20.19.5+dfsg+~cs20.19.12-2
20.19.5+dfsg+~cs20.19.12-3
20.19.5+dfsg+~cs20.19.12-4
20.19.5+dfsg+~cs20.19.24-1
22.*
22.12.0+dfsg-1
22.12.0+dfsg-2
22.12.0+dfsg-3
22.14.0+dfsg-1
22.18.0+dfsg-1
22.18.0+dfsg+~cs22.17.2-1
22.18.0+dfsg+~cs22.17.2-2
22.19.0+dfsg+~cs22.18.0-1
22.21.1+dfsg+~cs22.19.0-1
22.21.1+dfsg+~cs22.19.0-2
22.21.1+dfsg+~cs22.19.0-3
22.21.1+dfsg+~cs22.19.0-4
22.21.1+dfsg+~cs22.19.0-5
22.21.1+dfsg+~cs22.19.0-6
22.22.0+dfsg+~cs22.19.6-1
22.22.0+dfsg+~cs22.19.13-1
22.22.0+dfsg+~cs22.19.13-2
22.22.1+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-3
24.*
24.11.1+dfsg+~cs24.10.1-1
24.11.1+dfsg+~cs24.10.1-2
24.12.0+dfsg+~cs24.10.4-1
24.13.0+dfsg+~cs24.10.7-1
24.13.0+dfsg+~cs24.10.7-2
24.14.0+dfsg+~cs24.12.0-1
24.14.0+dfsg+~cs24.12.0-2
24.14.1+dfsg+~cs24.12.0-1
24.15.0+dfsg+~cs24.12.2-1
24.16.0+dfsg+~cs24.13.1-1
24.16.0+dfsg+~cs24.13.1-2
24.17.0+dfsg+~cs24.13.2-1
24.18.0+dfsg+~cs24.13.2-1
24.19.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-2
24.21.0+dfsg+~cs24.13.4-1
24.22.0+dfsg+~cs24.19.2-1
24.22.0+dfsg+~cs24.19.2-2
24.22.1+dfsg+~cs24.19.2-1
24.22.2+dfsg+~cs24.19.2-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
python-brotlicffi

Package

Name
python-brotlicffi
Purl
pkg:deb/debian/python-brotlicffi?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.0.0+ds1-1
1.1.0.0+ds1-2
1.2.0.0+ds-1
1.2.0.0+ds-2
1.2.0.1+ds-1
1.2.0.1+ds1-1
1.2.0.1+ds1-2
1.2.0.1+ds1-3
1.2.0.1+ds1-4
1.2.0.1+ds1-5
1.2.0.1+ds1-6
1.2.0.2+ds-1
1.2.1.0+ds-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
Debian:14
brotli

Package

Name
brotli
Purl
pkg:deb/debian/brotli?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.0-4.1

Affected versions

1.*
1.1.0-2
1.2.0-1
1.2.0-2
1.2.0-3
1.2.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
edk2

Package

Name
edk2
Purl
pkg:deb/debian/edk2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.08+ds-3

Affected versions

2025.*
2025.02-8
2025.02-9
2025.02-10
2025.05-1
2025.05-2
2025.08.01-1
2025.08.01-2
2025.08.01-3
2025.08.01-4
2025.08.01-5
2025.08.01-6
2025.11-1
2025.11-2
2025.11-3
2025.11-4
2025.11-5
2026.*
2026.02-1
2026.02-2
2026.02-3
2026.05-1
2026.05-2
2026.05-3
2026.08+ds-1
2026.08+ds-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
24.22.1+dfsg+~cs24.19.2-1

Affected versions

20.*
20.19.2+dfsg-1
20.19.4+dfsg-1
20.19.5+dfsg+~cs20.19.12-1
20.19.5+dfsg+~cs20.19.12-2
20.19.5+dfsg+~cs20.19.12-3
20.19.5+dfsg+~cs20.19.12-4
20.19.5+dfsg+~cs20.19.24-1
22.*
22.12.0+dfsg-1
22.12.0+dfsg-2
22.12.0+dfsg-3
22.14.0+dfsg-1
22.18.0+dfsg-1
22.18.0+dfsg+~cs22.17.2-1
22.18.0+dfsg+~cs22.17.2-2
22.19.0+dfsg+~cs22.18.0-1
22.21.1+dfsg+~cs22.19.0-1
22.21.1+dfsg+~cs22.19.0-2
22.21.1+dfsg+~cs22.19.0-3
22.21.1+dfsg+~cs22.19.0-4
22.21.1+dfsg+~cs22.19.0-5
22.21.1+dfsg+~cs22.19.0-6
22.22.0+dfsg+~cs22.19.6-1
22.22.0+dfsg+~cs22.19.13-1
22.22.0+dfsg+~cs22.19.13-2
22.22.1+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-3
24.*
24.11.1+dfsg+~cs24.10.1-1
24.11.1+dfsg+~cs24.10.1-2
24.12.0+dfsg+~cs24.10.4-1
24.13.0+dfsg+~cs24.10.7-1
24.13.0+dfsg+~cs24.10.7-2
24.14.0+dfsg+~cs24.12.0-1
24.14.0+dfsg+~cs24.12.0-2
24.14.1+dfsg+~cs24.12.0-1
24.15.0+dfsg+~cs24.12.2-1
24.16.0+dfsg+~cs24.13.1-1
24.16.0+dfsg+~cs24.13.1-2
24.17.0+dfsg+~cs24.13.2-1
24.18.0+dfsg+~cs24.13.2-1
24.19.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-1
24.20.0+dfsg+~cs24.13.3-2
24.21.0+dfsg+~cs24.13.4-1
24.22.0+dfsg+~cs24.19.2-1
24.22.0+dfsg+~cs24.19.2-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"
python-brotlicffi

Package

Name
python-brotlicffi
Purl
pkg:deb/debian/python-brotlicffi?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.1.0+ds-1

Affected versions

1.*
1.1.0.0+ds1-1
1.1.0.0+ds1-2
1.2.0.0+ds-1
1.2.0.0+ds-2
1.2.0.1+ds-1
1.2.0.1+ds1-1
1.2.0.1+ds1-2
1.2.0.1+ds1-3
1.2.0.1+ds1-4
1.2.0.1+ds1-5
1.2.0.1+ds1-6
1.2.0.2+ds-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111497.json"