CVE-2026-111497criticalexploração observadaCWE-252CWE-787

CVE-2026-111497: falha crítica em Google Brotli

Out-of-Bounds Write in Google Brotli Decoder

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Brotli+ Monitorar nodejs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

94Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck, tem alerta oficial do governo brasileiro e tem prova de conceito pública.

ssvc Actcvss 9.2epss 83%
da publicação à armano mesmo dia
Publicada no NVD22 de out.
1ª PoC21 de out.
VulnCheck+4d
Alerta oficial no Brasil

O governo federal publicou alerta, recomendação ou boletim que cita esta vulnerabilidade.

  • CTIR Gov · ALERTA 102/2026 · 28 out 2026Vulnerabilidade crítica no Brotli - Googleler no gov.br ↗
  • CISC Gov.br · 27 out 2026Boletim do CISC de Vulnerabilidadesler no gov.br ↗
Fonte: CTIR Gov (GSI) e CISC Gov.br, sob licença CC BY-ND 3.0.
Ação exigida pela CISAprazo federal: 2026-11-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Google · Brotli
PoCs públicas encontradas — 123
githubgithub.com/assetnote/node2shell-scanner★ 85githubgithub.com/dimasma0305/CVE-2026-111497-POC★ 77githubgithub.com/trailofbits/brotli-checker★ 68githubgithub.com/syrex1013/CVE-2026-111497-node2shell★ 52githubgithub.com/caveeroo/cve-2026-111497-wordpress-poc★ 31githubgithub.com/CaterMaoZi/CVE-2026-111497-POC★ 17githubgithub.com/ZeroHackOrg/node2shell-poc★ 8githubgithub.com/hypnguyen1209/CVE-2026-111497★ 7githubgithub.com/ikow/brotli2crash★ 6githubgithub.com/tc4dy/CVE-2026-111497-Toolkit★ 4githubgithub.com/GlobularOne/HTTP2Shell-PoC★ 4githubgithub.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn★ 3githubgithub.com/fortbridge/cve-2026-111497-wordpress-pingback-brotli★ 3githubgithub.com/shivrajem/node2shell-detect★ 3githubgithub.com/Hika-sec/http2shell-CVE-2026-111497★ 2githubgithub.com/CompleteTech-Security/node2shell-check★ 2githubgithub.com/CompleTech-Security/http2shell-check★ 2githubgithub.com/CompleTech-Security/node2shell-check★ 2githubgithub.com/CompleTetech-Security/node2shell-check★ 2githubgithub.com/googlesky/CVE-2026-111497★ 2githubgithub.com/Secragon/node2shell-radar★ 2githubgithub.com/tani2shell/node2shell-lab★ 2githubgithub.com/Arkango/CVE-2026-111497★ 2githubgithub.com/CompleteTech-Security/http2shell-check★ 2githubgithub.com/Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-111497★ 1githubgithub.com/SYM01/cve-2026-111497★ 1githubgithub.com/fieldse/brotli-node2shell-check★ 1githubgithub.com/Sami-AlEsh/nodejs-security-check★ 1githubgithub.com/depuschm/brotli-k8s-scan★ 1githubgithub.com/Nyamort/brotli-pingback-lab★ 1githubgithub.com/Sumit0x00/node2shell★ 1githubgithub.com/atiilla/CVE-2026-111497-Node2Shell★ 1githubgithub.com/EQSTLab/CVE-2026-111497★ 1githubgithub.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup★ 1githubgithub.com/Ghost-Bx1/Node2Shell-CVE-2026-111497★ 1githubgithub.com/FranklinF25/http2shell★ 1githubgithub.com/0xredash/CVE-2026-111497★ 1githubgithub.com/fieldse/http2shell-checker★ 1githubgithub.com/dansaurabh/brotli2shell_Hunter★ 1githubgithub.com/0xBlackash/CVE-2026-111497★ 1githubgithub.com/fbuff-tools/http2shell-checker★ 1githubgithub.com/pt-act/node2shell-cve-2026-111497★ 1githubgithub.com/CompleTetech-Security/http2shell-check★ 1githubgithub.com/AdapptOnAzure/cve-2026-111497-mitigation★ 1githubgithub.com/Charlie-Netdevops/node-hostcheck★ 1githubgithub.com/yavuzsemih/brotli-secfix★ 1githubgithub.com/ionsec/node2shell-detector★ 1githubgithub.com/mehmet-emir-eroglu/NODE2SHELL★ 1githubgithub.com/tal7aouy/node2shell-scanner★ 1githubgithub.com/timosar/woff2shell★ 0githubgithub.com/CompleteTech-LLC/node2shell-check★ 0githubgithub.com/ks-labs/brotli-patch★ 0githubgithub.com/duytien241/nodejs-CVE-2026-111497★ 0githubgithub.com/queso/formbricks-patched★ 0githubgithub.com/axisops/CVE-2026-111497★ 0githubgithub.com/paulmann/CVE-2026-111497★ 0githubgithub.com/akaihigurashi/brotli2scan★ 0githubgithub.com/avatarnewyork/brotli-check★ 0githubgithub.com/gik2927/CVE-2026-111497-DOS-★ 0githubgithub.com/incu-tech/october-cyber-family★ 0githubgithub.com/datmt/emudhra-fix★ 0githubgithub.com/AmanSin001/node-brotli-check★ 0githubgithub.com/fuzheado/n2s-buildpack-probe★ 0githubgithub.com/Blackman99/lotstamp★ 0githubgithub.com/utkarsssh17/cve-2026-111497-brotli-poc★ 0githubgithub.com/s1ko/poc-cve-2026-111497★ 0githubgithub.com/mnk-works/cve-2026-111497-rce-checker★ 0githubgithub.com/datmt/vulcheck★ 0githubgithub.com/TahuCryptsi/brotli-distro-check★ 0githubgithub.com/apaonum/brotli-cve-check★ 0githubgithub.com/emirwtz/CVE-2026-111497★ 0githubgithub.com/mahumadad/CVE-2026-111497-assessment★ 0githubgithub.com/AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan★ 0githubgithub.com/suominen/CVE-2026-111497★ 0githubgithub.com/Nucklear/CVE-2026-111497-working★ 0githubgithub.com/hayupisama/quarkus-brotli-audit★ 0githubgithub.com/lesterlam/node2shell★ 0githubgithub.com/bastet-ai/brotli-firing-range★ 0githubgithub.com/lushinshang/cve-2026-111497-http2shell-guide★ 0githubgithub.com/piecar21/CVE-2026-111497★ 0githubgithub.com/thebarel/CVE-2026-111497★ 0githubgithub.com/jeffschafer/Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497★ 0githubgithub.com/amier-ge/node2shell-checker★ 0githubgithub.com/tikarammardi/CVE-2026-111497★ 0githubgithub.com/amier-ge/Node2Shell★ 0githubgithub.com/hkoeck/node2shell-status★ 0githubgithub.com/Quaerendir/node2shell-audit★ 0githubgithub.com/foxcornlab/node2shell-inventory-scanner★ 0githubgithub.com/TahuCryptsi/node-brotli-check★ 0githubgithub.com/mehmet-emir-eroglu/CVE-2026-111497★ 0githubgithub.com/sakai-sktech/brotli-check★ 0githubgithub.com/RedSideSecurity/node2shell★ 0githubgithub.com/miracle438/node2shell-two-stage★ 0githubgithub.com/adachis/pillow-patched-brotli★ 0githubgithub.com/Sable-Research/brotli-decoder-overflow★ 0githubgithub.com/ChriSec7/CVE-2026-111497-POC★ 0githubgithub.com/Certbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-★ 0githubgithub.com/MelissaSkywalkz/broccoli2shell-gis★ 0githubgithub.com/sam00/Node2Shell-CVE-2026-111497-POC★ 0githubgithub.com/aymenkmar/node2shell-check★ 0vulncheckvulncheck.com/xdb/c5e251796b95não verificadovulncheckvulncheck.com/xdb/44200cae0fdfnão verificadovulncheckvulncheck.com/xdb/edcf570219f2não verificadovulncheckvulncheck.com/xdb/e92245af32banão verificadovulncheckvulncheck.com/xdb/749a90cc9ccdnão verificadovulncheckvulncheck.com/xdb/e815eab86db5não verificadovulncheckvulncheck.com/xdb/a32978d5e9c6não verificadovulncheckvulncheck.com/xdb/887c72771b58não verificadovulncheckvulncheck.com/xdb/963da2252eebnão verificadovulncheckvulncheck.com/xdb/023b9597b568não verificadovulncheckvulncheck.com/xdb/99735b8dd142não verificadovulncheckvulncheck.com/xdb/5fe47e0d73benão verificadovulncheckvulncheck.com/xdb/441e51bdf75cnão verificadovulncheckvulncheck.com/xdb/5477a5750a52não verificadovulncheckvulncheck.com/xdb/e036a897b3c0não verificadovulncheckvulncheck.com/xdb/c2369915a572não verificadovulncheckvulncheck.com/xdb/93d3d642e1c6não verificadovulncheckvulncheck.com/xdb/b4edc5da03c0não verificadovulncheckvulncheck.com/xdb/f1a058824b30não verificadovulncheckvulncheck.com/xdb/f0a2c45e431cnão verificadovulncheckvulncheck.com/xdb/5dd299a1e34enão verificadovulncheckvulncheck.com/xdb/b9a40aa6515cnão verificadovulncheckvulncheck.com/xdb/90f51af75865não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.