Brotli CVE-2026-111497: Memory Corruption, Information Disclosure, and RCE via Crafted Compressed Streams

CVE-2026-111497 is a security vulnerability affecting the Brotli stream decoder, which is a compression algorithm used in various software applications. The flaw allows attackers to craft specially designed Brotli-compressed data that, when decompressed by a vulnerable program, can cause memory corruption, information disclosure, and potentially remote code execution (RCE).

When an application decompresses a malicious Brotli stream, it incorrectly treats invalid block switching as a request for more input rather than an error. This leads to writing data beyond the 8-byte internal buffer, causing the process to crash or disclose memory contents. In certain circumstances, skilled attackers may leverage these conditions to execute arbitrary code on the target system, potentially compromising its security and integrity.

The vulnerability exists in numerous software products and frameworks, including Node.js, .NET, Python Brotli, Bun, Envoy, Istio, and others. While proof-of-concept demonstrations and public research have shown the potential for exploitation, there have been no reports of malicious exploitation in the wild at this time.

Attackers can exploit this vulnerability through two primary vectors: server-side and client-side decompression. In the server-side scenario, an attacker sends a crafted Brotli-compressed request to a vulnerable server, which then decompresses the stream using the flawed decoder. This can result in the same consequences as the client-side vector.

Conversely, in the client-side vector, an attacker tricks a backend client, crawler, proxy, or AI agent into retrieving an attacker-controlled URL. The client then receives a response marked with Content-Encoding: br and automatically decompresses it using the vulnerable decoder, potentially leading to the same security issues.

To mitigate the risk of CVE-2026-111497, it is crucial for developers and system administrators to update their software to patched versions as soon as possible. Additionally, monitoring for potential signs of the vulnerability in their environments, such as service unresponsiveness, connection drops, or unusual process behavior, can help identify and address any potential security breaches.