CVE-2026-111497 with a CVSS score of 4.0 is a buffer overflow vulnerability located in the Brotli decoder component, specifically within the c/dec/decode.c file. This flaw affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms, as well as specific Palo Alto Networks PAN-OS releases including 11.2.3, where Brotli encoding is unsupported. The vulnerability allows a remote unauthenticated attacker to exploit the system by sending a crafted Brotli-compressed stream, which corrupts adjacent decoder state memory. This attack vector requires no prior authentication or user interaction, enabling the attacker to disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. The business impact is significant, as Brotli is commonly used by many HTTP-based applications, including Node.js, meaning successful exploitation could compromise the integrity and availability of critical network infrastructure and data processing systems. The flaw is classified as an out-of-bounds write, posing a direct threat to systems that process compressed traffic without adequate input validation or memory protection mechanisms.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-111497 with a CVSS score of 4.0 is a buffer overflow vulnerability located in the Brotli decoder component, specifically within the c/dec/decode.c file. This flaw affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms, as well as specific Palo Alto Networks PAN-OS releases including 11.2.3, where Brotli encoding is unsupported. The vulnerability allows a remote unauthenticated attacker to exploit the system by sending a crafted Brotli-compressed stream, which corrupts adjacent decoder state memory. This attack vector requires no prior authentication or user interaction, enabling the attacker to disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. The business impact is significant, as Brotli is commonly used by many HTTP-based applications, including Node.js, meaning successful exploitation could compromise the integrity and availability of critical network infrastructure and data processing systems. The flaw is classified as an out-of-bounds write, posing a direct threat to systems that process compressed traffic without adequate input validation or memory protection mechanisms.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]