Vulnerabilities & Exploits
Sweet Security says it saw attempts to exploit critical Google Brotli flaw CVE-2026-111497 in 88% of the environments it monitors after disclosure. The decoder is bundled in Node.js, Bun, Envoy, Python and Go software.
A malformed compressed-data block is mistaken for a request for more input, so the decoder keeps going and writes past its buffer. That can crash an application or let an unauthenticated attacker execute code in its process.
Each bundled copy needs its own fix, so a clean host package inventory can coexist with a vulnerable application image or executable. Sweet’s report is a product showcase; its virtual-patching recommendation is vendor advice, not independent evidence that the product is necessary. For teams running these stacks, exposure depends on the decoder each service actually loads.
1 source · 5h ago
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: Release Notes.
Patch available KB5133964 Download →
CISA federal remediation date Nov 10
Help Net Security
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up - Help Net Security
Sweet Security Virtual Patching blocks attacks while patches arrive.
originalPart of the PlainSec briefing for 2026-11-03
Every edition of this story: Brotli flaw leaves bundled runtimes exposed after patching