CVE-2026-111497
Known exploited · CISA KEV
Microsoft patch: Release Notes.
Patch available KB5133964 Download →
CISA federal remediation date Nov 10
Vulnerabilities · 8h ago
CISA confirmed attackers are actively exploiting a critical buffer overflow in Google’s Brotli decoder, affecting versions 1.0.3 through 1.2.0 (CVE-2026-111497).
Brotli expands compressed data; the flaw can make its decoder write beyond the memory reserved for that output. A server decoding Brotli-compressed traffic while handling a network request can therefore expose the flaw remotely, without requiring an attacker to log in.
Brotli may be bundled inside application dependencies or server stacks, so a vulnerable copy can remain even when no separately managed Brotli package appears in an inventory. For teams whose internet-facing applications accept compressed traffic, exposure follows the decoder into the service handling those requests.
Known exploited · CISA KEV
Microsoft patch: Release Notes.
Patch available KB5133964 Download →
CISA federal remediation date Nov 10
1 source covering this story
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
Part of the PlainSec briefing for 2026-10-28