Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026110401111818 | Publication Time | 2026-11-04 13:48:19 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-11-04 13:48:19 |
| Impact Level | Medium | ||
| [Subject] 【Vulnerability Alert】Google Brotli Has a High-Risk Security Vulnerability (CVE-2026-111497). Please Verify and Take Action as Soon as Possible |
|||
| [Content] Forwarded from the National Institute of Cyber Security NISAC-200-202611-00000004 Researchers have discovered an Out-of-Bounds Write vulnerability (CVE-2026-111497) in Google Brotli. An unauthenticated remote attacker can use a specially crafted Brotli compressed stream to cause the decoder to write memory beyond the bounds of its internal buffer, potentially disclosing sensitive memory contents, causing a denial of service, or executing arbitrary code. This vulnerability has already been exploited by attackers. Please verify and take action as soon as possible. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] Google Brotli versions 1.0.3 through versions earlier than 1.0.10 (excluding 1.0.10), version 1.1.0, and version 1.2.0 |
|||
| [Recommended Actions] The vendor has released patches or updates to address this vulnerability. Please refer to the official instructions for remediation. The URLs are as follows: https://github.com/google/brotli/releases/tag/v1.0.10 https://github.com/google/brotli/releases/tag/v1.1.1 https://github.com/google/brotli/releases/tag/v1.2.1 In addition, many software products and development frameworks share the Brotli decompression component. The scope of impact includes Node.js, .NET, Python, PHP, PowerShell, and other third-party applications. Please check for security patches or updates released by the respective software vendors and take the necessary remedial actions. |
|||
|
[Reference] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-111497 |
|||