{"id":"EM-20261028-PYDE","url":"https://cyber.eventmonitor.net/incident/EM-20261028-PYDE/","type":"cve","title":"Google Brotli Unchecked Return Value Vulnerability","subtitle":"CVE-2026-111497","subject":"CVE-2026-111497","status":"Confirmed","severity":"high","affected":["Google Brotli"],"headline":"5 hours from first report to confirmed exploitation.","born":"2026-10-28T17:43:40.833Z","firstSignal":"2026-10-28T12:46:09.000Z","lastSignal":"2026-11-03T17:33:48.000Z","updated":"2026-11-04T09:04:34.499Z","revision":2,"life":[{"status":"Born","at":"2026-10-28T17:43:40.833Z","why":"second independent source: C123 Provider status pages (Statuspage)"},{"status":"Developing","at":"2026-10-28T17:43:40.833Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-28T17:43:40.833Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-28T12:46:09.000Z","what":"First signal: C10 Canadian Centre for Cyber Security"},{"at":"2026-10-28T17:43:40.833Z","what":"Born: second source, C123 Provider status pages (Statuspage). Page EM-20261028-PYDE created."},{"at":"2026-10-28T17:43:40.833Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-10-31T03:15:00.000Z","what":"Source joined: C45 Palo Alto Networks Security Advisories"},{"at":"2026-10-31T03:15:00.000Z","what":"Severity raised to High by C45"},{"at":"2026-11-03T17:33:48.000Z","what":"Source joined: C26 GitHub Advisory Database"}],"stages":[{"name":"Disclosed","at":"2026-10-22T14:17:37.190Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-22T14:17:37.190Z","detail":"CVSS 9.2 · EPSS 82.6%"},{"name":"Exploited","at":"2026-10-28T17:43:40.833Z","detail":"C1 CISA KEV, fix by 2026-11-10"},{"name":"Advisories","at":"2026-10-28T12:46:09.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":"2026-10-31T03:15:00.000Z","detail":"C45 published"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-10, then 14 quiet days"}],"signals":[{"at":"2026-10-28T12:46:09.000Z","source":"C10","sourceName":"Canadian Centre for Cyber Security","role":"Government","severity":2,"title":"AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497","text":null,"url":"https://cyber.gc.ca/en/alerts-advisories/al26-027-critical-vulnerability-impacting-google-brotli-cve-2026-111497"},{"at":"2026-10-28T17:43:40.833Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: Brotli Remote Code Execution Vulnerabilitie  [CVE-2026-111497]","text":"investigating. Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Akamai products. Customers and partners can find more det","url":"https://stspg.io/4bgr0nwln15p"},{"at":"2026-10-31T03:15:00.000Z","source":"C45","sourceName":"Palo Alto Networks Security Advisories","role":"Vendor","severity":3,"title":"CVE-2026-111497 Portfolio Statu : Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Network  Product  (Severity: CRITICAL)","text":null,"url":"https://security.paloaltonetworks.com/CVE-2026-111497"},{"at":"2026-11-03T17:13:54.262Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: Brotli Remote Code Execution Vulnerabilitie  [CVE-2026-111497]","text":"resolved. As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497). All systems are secured, and we have detected no","url":"https://stspg.io/4bgr0nwln15p"},{"at":"2026-11-03T17:33:48.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-p3jp-9v83-76w9: Micro oft Security Advi ory CVE-2026-111497 - .NET Brotli Decoder Out-of-bound  Write Vulnerability","text":"nuget:Microsoft.DotNet.ILCompiler, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64, nuget:Mi","url":"https://github.com/advisories/GHSA-p3jp-9v83-76w9"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-22T14:17:37.190","score":9.2,"severity":"CRITICAL","desc":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execu","product":"Google Brotli","seen":1793783074499},"kev":{"added":"2026-10-27","due":"2026-11-10","ransomware":"Unknown","vendor":"Google","product":"Brotli","name":"Google Brotli Unchecked Return Value Vulnerability"},"epss":{"epss":0.82641,"pct":0.99667,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}