Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Imported from official source
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. …
This version
- Version
- 1 of 3
- Recorded
- October 27, 2026 02:01
- Change
- Initial
- Content hash
7985a61c840a940adb48b7efaaec3ec4- All versions
- Revision history