Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

Reported by Tenable (Satnam Narang)

Summary by Cyber Security News27 Oct 2026, 02:19 CET

About this summary. This is a short excerpt from the description that Tenable published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497

Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.

Read the full article at Tenable →

Source attribution: headline and facts are from Tenable (tenable.com). Summary method: excerpt of the source description. See our source attribution policy.