Out-of-bounds read In github.com/andybalholm/brotli
Description
Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 pypi | >=1.0.3 <1.2.1 | 1.2.1 | |
pypi | >=1.0.3 <1.2.1.0 | 1.2.1.0 | |
 debian 12 | =1.0.9-2 || >=0 <1.0.9-2+deb12u1 | 1.0.9-2+deb12u1 | |
debian 13 | =1.1.0-2 || >=0 <1.1.0-2+deb13u1 | 1.1.0-2+deb13u1 | |
debian 14 | =1.1.0-2 || =1.2.0-1 || =1.2.0-2 || =1.2.0-3 || =1.2.0-4 || >=0 <1.2.0-4.1 | 1.2.0-4.1 | |
debian 12 | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || =18.20.4+dfsg-1~deb12u1 || =18.20.4+dfsg-1~deb12u2 || =18.20.4+dfsg-1~deb12u3 || =20.10.0+dfsg-1 || =20.12.2+dfsg-1 || =20.13.0+dfsg-1 || =20.13.1+dfsg-1 || =20.13.1+dfsg-2 || =20.14.0+dfsg-1 || =20.14.0+dfsg-2 || =20.14.0+dfsg-3 || =20.15.0+dfsg-1 || =20.15.1+dfsg-1 || =20.16.0+dfsg-1 || =20.17.0+dfsg-1 || =20.17.0+dfsg-2 || =20.18.0+dfsg-1 || =20.18.0+dfsg-2 || =20.18.1+dfsg-1 || =20.18.1+dfsg-2 || =20.18.2+dfsg-1 || =20.18.2+dfsg-2 || =20.18.2+dfsg-3 || =20.18.2+dfsg-4 || =20.18.3+dfsg-1 || =20.19.0+dfsg-1 || =20.19.0+dfsg-2 || =20.19.0+dfsg1-1 || =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 || =24.22.1+dfsg+~cs24.19.2-1 || =24.22.2+dfsg+~cs24.19.2-1 | - | |
debian 13 | =20.19.2+dfsg-1 || =20.19.2+dfsg-1+deb13u1 || =20.19.2+dfsg-1+deb13u2 || =20.19.2+dfsg-1+deb13u3 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 || =24.22.1+dfsg+~cs24.19.2-1 || =24.22.2+dfsg+~cs24.19.2-1 | - | |
 alpine v3.21 | >=1.0.3 <1.1.1-r0 | 1.1.1-r0 | |
alpine v3.23 | >=1.0.3 <1.2.1-r0 | 1.2.1-r0 | |
alpine v3.24 | >=1.0.3 <1.2.1-r0 | 1.2.1-r0 |
1-10 of 47
10
Aliases
1. CVE-2026-1114972. NVD-2026-1114973. OSV-2026-1114974. OSV-DEBIAN-2026-1114975. OSV-ALPINE-2026-1114976. OSV-EEF-2026-1114977. OSV-GO-2026-68888. GHSA-9v8h-qqgm-4m359. GCVE-2026-11149710. lists.debian.org11. SECURITY-TRACKER-CVE-2026-11149712. SECURITY-CVE-2026-11149713. ellio.tech14. https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111497.json15. https://github.com/andybalholm/brotli/releases/tag/v1.2.716. GHSA-c9gr-gmg4-2vqv
References
1. https://github.com/dotnet/announcements/issues/4942. https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb123. https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b64. https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a05. https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b6. https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml7. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases8. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high9. https://opensourcemalware.com/blog/node2shell-affects-python10. https://patchtheplanet.org/brotli11. https://pypi.org/project/Brotli12. https://pypi.org/project/brotlicffi13. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-11149714. https://www.cve.org/CVERecord?id=CVE-2026-11149715. https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml16. https://github.com/google/brotli/releases/tag/v1.2.117. https://github.com/google/brotli/releases/tag/v1.1.118. https://github.com/google/brotli/releases/tag/v1.0.1019. https://github.com/andybalholm/brotli/releases/tag/v1.2.720. https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds21. https://cert-portal.siemens.com/productcert/html/ssa-898633.html22. https://cert-portal.siemens.com/productcert/html/ssa-443410.html23. https://cert-portal.siemens.com/productcert/html/ssa-045512.html24. https://broccoli2shell.com25. http://www.openwall.com/lists/oss-security/2026/10/23/2526. http://www.openwall.com/lists/oss-security/2026/10/24/627. http://www.openwall.com/lists/oss-security/2026/10/26/1228. http://www.openwall.com/lists/oss-security/2026/10/26/1329. http://www.openwall.com/lists/oss-security/2026/10/26/1630. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/javascript/cves/2026/CVE-2026-111497.yaml31. https://github.com/CaterMaoZi/CVE-2026-111497-POC32. http://www.openwall.com/lists/oss-security/2026/11/03/233. https://github.com/yjh0502/erl-brotli/issues/2334. https://cna.erlef.org/cves/CVE-2026-111497.html35. https://github.com/yjh0502/erl-brotli/releases/tag/v0.3.436. https://github.com/yjh0502/erl-brotli/commit/1e2af9bebba40ee292abf51e19ac831c2658ca4737. https://github.com/yjh0502/erl-brotli/commit/7498e1c743c71a99636e8f897b6b016433830d6d38. https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.