GoogleAnalysisGoogle Brotli decompression flaw triggers widespread downstream runtime patching
What happened.CISA added Google Brotli buffer overflow vulnerability CVE-2026-111497 to its Known Exploited Vulnerabilities catalog as downstream runtime maintainers issued urgent updates.
Why it matters.Compression libraries operate transparently at network ingress points, exposing edge gateways and microservice sidecars to unauthenticated memory corruption. When core decompression utilities fail, entire clusters face destabilization and unauthorized host inspection. Infrastructure architects must inventory all edge proxies and container bases for vulnerable Brotli shared libraries. Platform security teams should apply runtime dependency updates across all internet-facing service mesh proxies.
The technical specifications:
- Memory corruption: An out-of-bounds write flaw in Google Brotli versions 1.0.3 through 1.2.0 enables remote actors to corrupt decoder state buffers when processing crafted compressed payloads.
- Downstream blast radius: The vulnerability directly impacts major developer ecosystems embedding Brotli decompression, including Node.js web services, Envoy edge proxies, and Istio service meshes.
- Exploitation risk: Threat actors exploit decompression buffers to trigger denial of service crashes and execute arbitrary code on proxy endpoints handling untrusted inbound HTTP traffic.