Skip to content
VulniPulse
Sign in
Highest advisory severityCritical Exploited CISA KEV 5 vendors · 5 advisories

CVE-2026-111497

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability. In CISA KEV since 2026-10-27. Critical advisory severity (CVSS 9.2, NetApp).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Cisco publishes the next one.

VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-111497 key facts

CISA KEV
Listed on · federal remediation due
Highest advisory severity
Critical
CVSS base score
9.2 (NetApp), 9.2 (Palo Alto), 8.1 (Red Hat)
Weakness
CWE-787
Fixed releases
  • Palo Alto: Prisma Cloud - Application Security Transporter Client >= 0.2.9, PAN-OS >= 12.2.4-h1, PAN-OS >= 12.1.10-h3, PAN-OS >= 12.1.7-h11, PAN-OS >= 12.1.4-h13, PAN-OS >= 11.2.16-h1 and 4 more in the advisory
  • Red Hat: thunderbird-0:140.10.0-1.el8_10, brotli-0:1.0.9-10.el9_8.1, firefox-0:140.10.0-1.el10_1, firefox-0:140.10.0-1.el10_0, brotli-0:1.1.0-8.el10_2.1, brotli-0:1.0.6-5.el8_10 and 15 more in the advisory
Vendor advisories
5 from Cisco, Fortinet, NetApp, Palo Alto, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-111497; bulletin-wide values are not repeated here.

Is CVE-2026-111497 exploited?

Yes. CISA lists CVE-2026-111497 in its Known Exploited Vulnerabilities catalog (added ), which means CISA has evidence of exploitation in the wild.

How do I fix CVE-2026-111497?

Upgrade to a fixed release named by the vendor:

  • Palo Alto: Prisma Cloud - Application Security Transporter Client >= 0.2.9, PAN-OS >= 12.2.4-h1, PAN-OS >= 12.1.10-h3, PAN-OS >= 12.1.7-h11, PAN-OS >= 12.1.4-h13, PAN-OS >= 11.2.16-h1
  • Red Hat: thunderbird-0:140.10.0-1.el8_10, brotli-0:1.0.9-10.el9_8.1, firefox-0:140.10.0-1.el10_1, firefox-0:140.10.0-1.el10_0, brotli-0:1.1.0-8.el10_2.1, brotli-0:1.0.6-5.el8_10
  • This issue will be fixed in the upcoming releases of PAN-OS. (Palo Alto)
  • Refer Product Status table for details. (Palo Alto)
  • Limit exposure of services that decompress Brotli from untrusted peers, and restrict network access to those services where practical. Prefer not accepting or auto-decoding Content-Encoding: br from untrusted sources when the application allows that configuration. (Red Hat)

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor advisory comparison

Cisco

1 advisory
  • Advisory severityCritical

    Critical [CVE-2026-105482 +3] Vulnerabilities in node.js Affecting Cisco Products: October 2026

    cisco-sa-oct2026-node-js-Jj3SQ19uSource published

    This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: - CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution - CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters - CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits - CVE-2026-106069 -…

    Related products — impact not confirmed
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Workarounds
    • Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.
    Full advisory and evidenceOpen source bulletin

Fortinet

1 advisory
  • Advisory severityCritical9.8

    Critical [CVE-2026-105481 +9] Multiple Node.js CVEs

    FG-IR-26-187Source published Source updated

    This bulletin covers 10 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 - (low)This vulnerability affects…

    Related products — impact not confirmed
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

NetApp

1 advisory
  • Advisory severityCritical9.2

    Critical [CVE-2026-111497] Brotli Vulnerability in NetApp Products

    NTAP-20261023-0001Source published Source updated

    Google Brotli versions 1.0.3 through 1.2.0 are susceptible to a vulnerability known alternatively as Node2Shell or HTTP2Shell which when successfully exploited could allow malformed compressed input to write past the end of an internal decoder buffer. Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data or Denial of Service (DoS). Affected products: NetApp Console Agent Container (audit), ONTAP Select Deploy administration utility. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

    Affected products in this advisory
    • NetApp Console Agent Container (audit)
    • ONTAP Select Deploy administration utility
    Source-reported affected versions
    • 1.0.3
    • 1.2.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Palo Alto

1 advisory
  • Advisory severityCritical9.2

    Critical [CVE-2026-111497] Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks Products

    CVE-2026-111497Source published

    CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks Products

    Affected products in this advisory
    • Prisma Cloud
    • PAN-OS
    Source-reported affected versions
    • Prisma Cloud - Application Security Transporter Client < 0.2.9
    • PAN-OS < 12.2.4-h1
    • PAN-OS < 12.1.4-h13
    • PAN-OS < 11.2.4-h23
    Source-reported fixed versions
    • Prisma Cloud - Application Security Transporter Client >= 0.2.9
    • PAN-OS >= 12.2.4-h1
    • PAN-OS >= 12.1.10-h3
    • PAN-OS >= 12.1.7-h11

    6 more entries in the full advisory.

    Mitigation guidance
    • This issue will be fixed in the upcoming releases of PAN-OS.
    • Refer Product Status table for details.
    • Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.
    • Prisma Cloud - Application Security Transporter Client
    Workarounds
    • PAN-OSCustomers can mitigate the risk of this issue by taking any of the following actions:Disable Brotli Inspection via the CLI (PAN-OS 11.2.4 or higher):
    • Navigate to Device > Setup > Content-ID.
    • Locate the Content-ID settings pane and click the edit icon.Uncheck the Allow Brotli Encoding option.Commit the configuration changes.
    • or this Threat ID to protect against attacks for this vulnerability:
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.1

    High [CVE-2026-111497] Out-of-Bounds Write in Google Brotli Decoder

    CVE-2026-111497Source published Source updated

    Out-of-Bounds Write in Google Brotli Decoder. Red Hat rates this important (CVSS 8.1). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:10757 with package thunderbird-0:140.10.0-1.el8_10, brotli-0:1.0.9-10.el9_8.1, firefox-0:140.10.0-1.el10_1, firefox-0:140.10.0-1.el10_0. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10.

    Related products — impact not confirmed
    • Red Hat Enterprise Linux 8
    • Red Hat Enterprise Linux 9
    • Red Hat Enterprise Linux 10
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • thunderbird-0:140.10.0-1.el8_10
    • brotli-0:1.0.9-10.el9_8.1
    • firefox-0:140.10.0-1.el10_1
    • firefox-0:140.10.0-1.el10_0

    17 more entries in the full advisory.

    Mitigation guidance
    • Limit exposure of services that decompress Brotli from untrusted peers, and restrict network access to those services where practical. Prefer not accepting or auto-decoding Content-Encoding: br from untrusted sources when the application allows that configuration.
    Full advisory and evidenceOpen source bulletin

More Cisco advisories

All Cisco advisories

Follow CVE-2026-111497 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features