Vulnerabilities & Exploits

CISA confirms active exploitation of Brotli decoder flaw

CISA confirmed attackers are actively exploiting a critical buffer overflow in Google’s Brotli decoder, affecting versions 1.0.3 through 1.2.0 (CVE-2026-111497).

Brotli expands compressed data; the flaw can make its decoder write beyond the memory reserved for that output. A server decoding Brotli-compressed traffic while handling a network request can therefore expose the flaw remotely, without requiring an attacker to log in.

Brotli may be bundled inside application dependencies or server stacks, so a vulnerable copy can remain even when no separately managed Brotli package appears in an inventory. For teams whose internet-facing applications accept compressed traffic, exposure follows the decoder into the service handling those requests.

1 source · 9h ago

Timeline

• Nov 10 CISA federal deadline for CVE-2026-111497
• Oct 28 Reported by BleepingComputer
• Oct 27 CVE-2026-111497 added to CISA KEV

Sources

• Oct 28 BleepingComputer

  CISA warns of hackers now exploiting critical Node2Shell flaw

  On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.

  original

Part of the PlainSec briefing for 2026-10-28

Every edition of this story: CISA confirms active exploitation of Brotli decoder flaw

More from today

• Brotli attempts and Citrix PHP flaws raise code-execution risk