CVE-2026-111497criticalexplotación observadaCWE-252CWE-787

CVE-2026-111497: fallo crítico en Google Brotli

Out-of-Bounds Write in Google Brotli Decoder

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Brotli+ Monitorear nodejs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

94Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck, tiene alerta oficial del gobierno de Brasil y tiene prueba de concepto pública.

ssvc Actcvss 9.2epss 83%
de la publicación al armael mismo día
Publicada en NVD22 oct
1ª PoC21 oct
VulnCheck+4d
Alerta oficial en Brasil

El gobierno federal de Brasil publicó una alerta, recomendación o boletín que cita esta vulnerabilidad.

  • CTIR Gov · ALERTA 102/2026 · 28 oct 2026Vulnerabilidade crítica no Brotli - Googleleer en gov.br ↗
  • CISC Gov.br · 27 oct 2026Boletim do CISC de Vulnerabilidadesleer en gov.br ↗
Fuente: CTIR Gov (GSI) y CISC Gov.br, bajo licencia CC BY-ND 3.0.
Acción exigida por CISAplazo federal: 2026-11-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Google · Brotli
PoCs públicas encontradas — 123
githubgithub.com/assetnote/node2shell-scanner★ 85githubgithub.com/dimasma0305/CVE-2026-111497-POC★ 77githubgithub.com/trailofbits/brotli-checker★ 68githubgithub.com/syrex1013/CVE-2026-111497-node2shell★ 52githubgithub.com/caveeroo/cve-2026-111497-wordpress-poc★ 31githubgithub.com/CaterMaoZi/CVE-2026-111497-POC★ 17githubgithub.com/ZeroHackOrg/node2shell-poc★ 8githubgithub.com/hypnguyen1209/CVE-2026-111497★ 7githubgithub.com/ikow/brotli2crash★ 6githubgithub.com/tc4dy/CVE-2026-111497-Toolkit★ 4githubgithub.com/GlobularOne/HTTP2Shell-PoC★ 4githubgithub.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn★ 3githubgithub.com/fortbridge/cve-2026-111497-wordpress-pingback-brotli★ 3githubgithub.com/shivrajem/node2shell-detect★ 3githubgithub.com/Hika-sec/http2shell-CVE-2026-111497★ 2githubgithub.com/CompleteTech-Security/node2shell-check★ 2githubgithub.com/CompleTech-Security/http2shell-check★ 2githubgithub.com/CompleTech-Security/node2shell-check★ 2githubgithub.com/CompleTetech-Security/node2shell-check★ 2githubgithub.com/googlesky/CVE-2026-111497★ 2githubgithub.com/Secragon/node2shell-radar★ 2githubgithub.com/tani2shell/node2shell-lab★ 2githubgithub.com/Arkango/CVE-2026-111497★ 2githubgithub.com/CompleteTech-Security/http2shell-check★ 2githubgithub.com/Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-111497★ 1githubgithub.com/SYM01/cve-2026-111497★ 1githubgithub.com/fieldse/brotli-node2shell-check★ 1githubgithub.com/Sami-AlEsh/nodejs-security-check★ 1githubgithub.com/depuschm/brotli-k8s-scan★ 1githubgithub.com/Nyamort/brotli-pingback-lab★ 1githubgithub.com/Sumit0x00/node2shell★ 1githubgithub.com/atiilla/CVE-2026-111497-Node2Shell★ 1githubgithub.com/EQSTLab/CVE-2026-111497★ 1githubgithub.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup★ 1githubgithub.com/Ghost-Bx1/Node2Shell-CVE-2026-111497★ 1githubgithub.com/FranklinF25/http2shell★ 1githubgithub.com/0xredash/CVE-2026-111497★ 1githubgithub.com/fieldse/http2shell-checker★ 1githubgithub.com/dansaurabh/brotli2shell_Hunter★ 1githubgithub.com/0xBlackash/CVE-2026-111497★ 1githubgithub.com/fbuff-tools/http2shell-checker★ 1githubgithub.com/pt-act/node2shell-cve-2026-111497★ 1githubgithub.com/CompleTetech-Security/http2shell-check★ 1githubgithub.com/AdapptOnAzure/cve-2026-111497-mitigation★ 1githubgithub.com/Charlie-Netdevops/node-hostcheck★ 1githubgithub.com/yavuzsemih/brotli-secfix★ 1githubgithub.com/ionsec/node2shell-detector★ 1githubgithub.com/mehmet-emir-eroglu/NODE2SHELL★ 1githubgithub.com/tal7aouy/node2shell-scanner★ 1githubgithub.com/timosar/woff2shell★ 0githubgithub.com/CompleteTech-LLC/node2shell-check★ 0githubgithub.com/ks-labs/brotli-patch★ 0githubgithub.com/duytien241/nodejs-CVE-2026-111497★ 0githubgithub.com/queso/formbricks-patched★ 0githubgithub.com/axisops/CVE-2026-111497★ 0githubgithub.com/paulmann/CVE-2026-111497★ 0githubgithub.com/akaihigurashi/brotli2scan★ 0githubgithub.com/avatarnewyork/brotli-check★ 0githubgithub.com/gik2927/CVE-2026-111497-DOS-★ 0githubgithub.com/incu-tech/october-cyber-family★ 0githubgithub.com/datmt/emudhra-fix★ 0githubgithub.com/AmanSin001/node-brotli-check★ 0githubgithub.com/fuzheado/n2s-buildpack-probe★ 0githubgithub.com/Blackman99/lotstamp★ 0githubgithub.com/utkarsssh17/cve-2026-111497-brotli-poc★ 0githubgithub.com/s1ko/poc-cve-2026-111497★ 0githubgithub.com/mnk-works/cve-2026-111497-rce-checker★ 0githubgithub.com/datmt/vulcheck★ 0githubgithub.com/TahuCryptsi/brotli-distro-check★ 0githubgithub.com/apaonum/brotli-cve-check★ 0githubgithub.com/emirwtz/CVE-2026-111497★ 0githubgithub.com/mahumadad/CVE-2026-111497-assessment★ 0githubgithub.com/AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan★ 0githubgithub.com/suominen/CVE-2026-111497★ 0githubgithub.com/Nucklear/CVE-2026-111497-working★ 0githubgithub.com/hayupisama/quarkus-brotli-audit★ 0githubgithub.com/lesterlam/node2shell★ 0githubgithub.com/bastet-ai/brotli-firing-range★ 0githubgithub.com/lushinshang/cve-2026-111497-http2shell-guide★ 0githubgithub.com/piecar21/CVE-2026-111497★ 0githubgithub.com/thebarel/CVE-2026-111497★ 0githubgithub.com/jeffschafer/Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497★ 0githubgithub.com/amier-ge/node2shell-checker★ 0githubgithub.com/tikarammardi/CVE-2026-111497★ 0githubgithub.com/amier-ge/Node2Shell★ 0githubgithub.com/hkoeck/node2shell-status★ 0githubgithub.com/Quaerendir/node2shell-audit★ 0githubgithub.com/foxcornlab/node2shell-inventory-scanner★ 0githubgithub.com/TahuCryptsi/node-brotli-check★ 0githubgithub.com/mehmet-emir-eroglu/CVE-2026-111497★ 0githubgithub.com/sakai-sktech/brotli-check★ 0githubgithub.com/RedSideSecurity/node2shell★ 0githubgithub.com/miracle438/node2shell-two-stage★ 0githubgithub.com/adachis/pillow-patched-brotli★ 0githubgithub.com/Sable-Research/brotli-decoder-overflow★ 0githubgithub.com/ChriSec7/CVE-2026-111497-POC★ 0githubgithub.com/Certbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-★ 0githubgithub.com/MelissaSkywalkz/broccoli2shell-gis★ 0githubgithub.com/sam00/Node2Shell-CVE-2026-111497-POC★ 0githubgithub.com/aymenkmar/node2shell-check★ 0vulncheckvulncheck.com/xdb/c5e251796b95no verificadovulncheckvulncheck.com/xdb/44200cae0fdfno verificadovulncheckvulncheck.com/xdb/edcf570219f2no verificadovulncheckvulncheck.com/xdb/e92245af32bano verificadovulncheckvulncheck.com/xdb/749a90cc9ccdno verificadovulncheckvulncheck.com/xdb/e815eab86db5no verificadovulncheckvulncheck.com/xdb/a32978d5e9c6no verificadovulncheckvulncheck.com/xdb/887c72771b58no verificadovulncheckvulncheck.com/xdb/963da2252eebno verificadovulncheckvulncheck.com/xdb/023b9597b568no verificadovulncheckvulncheck.com/xdb/99735b8dd142no verificadovulncheckvulncheck.com/xdb/5fe47e0d73beno verificadovulncheckvulncheck.com/xdb/441e51bdf75cno verificadovulncheckvulncheck.com/xdb/5477a5750a52no verificadovulncheckvulncheck.com/xdb/e036a897b3c0no verificadovulncheckvulncheck.com/xdb/c2369915a572no verificadovulncheckvulncheck.com/xdb/93d3d642e1c6no verificadovulncheckvulncheck.com/xdb/b4edc5da03c0no verificadovulncheckvulncheck.com/xdb/f1a058824b30no verificadovulncheckvulncheck.com/xdb/f0a2c45e431cno verificadovulncheckvulncheck.com/xdb/5dd299a1e34eno verificadovulncheckvulncheck.com/xdb/b9a40aa6515cno verificadovulncheckvulncheck.com/xdb/90f51af75865no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.