CVE-2026-111497: CRITICAL buffer overflow in Keycloak Brotli decoder (CVSS 9.8) impacts <26.4.2-r4, <26.7.5-r3. Risk: remote code execution. Update to patched versions ASAP. https://radar.offseq.com/threat/keycloak-buffer-overflow-vulnerability-in-the-brotli-decoder-cdecdecode-cve-2026-111497-8960db3ac889f67b #OffSeq #Keycloak #Vuln #CVE2026111497

TL;DR CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. Because Brotli is bundled into runtimes, proxies, appliances and file tools, this Brotli vulnerability reaches far beyond one library. This page tracks the affected products, which have fixes and which are still waiting. Why It Matters CISA added the Brotli vulnerability to its Known Exploited Vulnerabilities catalog on October 27, 2026.

TL;DR Palo Alto Networks confirmed on October 26, 2026, that CVE-2026-111497, a critical Brotli decoder flaw, affects PAN-OS 12.2, 12.1 and 11.2. This PAN-OS Brotli vulnerability also hits the Prisma Cloud Application Security Transporter Client. Hotfixes are listed for each affected branch, while PAN-OS 11.1 and 10.2 are not affected. Why It Matters Brotli is a compression library used across the web.

TL;DR On October 27, CISA added two actively exploited flaws to its Known Exploited Vulnerabilities list, better known as the CISA KEV catalog. The first, CVE-2026-48356, hits Adobe Commerce and Magento. The second, CVE-2026-111497, is a Brotli vulnerability in Google's widely used compression library. CISA says it has evidence of active exploitation for both flaws. Federal agencies must patch by November 10, 2026.

TL;DR Broadcom has issued VMSA-2026-0008 for a critical VMware SDDC Manager vulnerability, tracked as CVE-2026-111497. The flaw scores 9.8 on CVSS v3 in SDDC Manager 9.1.1. It stems from the same Brotli vulnerability that CISA added to its KEV catalog on October 27. A bug in the Node.js Brotli decoder lets attackers run code on SDDC Manager. Patches are still pending, but Broadcom offers workarounds.

TL;DR Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2026-114148, a Linux tarball ownership flaw. The release also completes fixes for two October 13 bugs that were not fully patched. Why It Matters .NET runs a huge range of web apps, APIs and services.

Microsoft has released emergency out-of-band updates across active versions of its flagship development platform. Specifically, developers patched .NET 8, 9, and 10 while shipping the .NET 11 Release Candidate 3 build. These swift updates remediate the severe .NET Brotli vulnerability that threatens server memory integrity. Furthermore, this memory corruption defect stems from a critical flaw within standard Brotli compression decoders. Consequently, software applications processing compressed payloads face immediate exploitation risks unless administrators apply protective fixes.

A critical flaw within Google's Brotli compression algorithm has sent shockwaves through the software industry. Specifically, the Brotli CVE-2026-111497 vulnerability permits unauthenticated attackers to corrupt server memory remotely. Security researchers have already demonstrated practical remote code execution against modern cloud stacks. Furthermore, the defect affects multiple prominent application runtimes and cloud proxies. Because maintainers embedded the vulnerable library across diverse languages, fixing one platform does not safeguard the others.

CVE-2026-111497: a Brotli decoder flaw in Node.js. How apps become exposed, what Imperva showed, and what to check before patching.

OpenAIは、Googleが開発した圧縮ツール「Brotli」に、リモートコード実行につながる脆弱性が存在することを発見し、その詳細を共有しました。この脆弱性は「CVE-2026-111497」というCVE番号が割り当てられており、通称として「Node2Shell」や「HTTP2Shell」といった名称も用いられています。 OpenAIによる脆弱性の発見経緯 OpenAIは、自身がAIを活用してOSSプロジェクトのセキュリティ強化を目指す枠組み「Patch the Planet」の一環として、この脆弱性の詳細を公開しました。 この脆弱性は、OpenAIが実施している「レッドチーム演習」によっ…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a Brotli decoder bug that "permits remote code execution." It also drops trust in the compromised eMudhra certificates. Why It Matters Node.js runs countless web servers, APIs and build tools. Three of the high-severity bugs weaken TLS hostname checks, which protect connections from impersonation.