{"id":"EM-20261031-PYDE","url":"https://cyber.eventmonitor.net/incident/EM-20261031-PYDE/","type":"cve","title":"Google Brotli Unchecked Return Value Vulnerability","subtitle":"CVE-2026-111497","subject":"CVE-2026-111497","status":"Confirmed","severity":"high","affected":["Google Brotli"],"headline":"58 hours from first report to confirmed exploitation.","born":"2026-10-31T03:15:00.000Z","firstSignal":"2026-10-28T17:43:40.833Z","lastSignal":"2026-11-03T17:33:48.000Z","updated":"2026-11-04T14:43:58.877Z","revision":2,"life":[{"status":"Born","at":"2026-10-31T03:15:00.000Z","why":"second independent source: C45 Palo Alto Networks Security Advisories"},{"status":"Developing","at":"2026-10-31T03:15:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-31T03:15:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-28T17:43:40.833Z","what":"First signal: C123 Provider status pages (Statuspage)"},{"at":"2026-10-31T03:15:00.000Z","what":"Born: second source, C45 Palo Alto Networks Security Advisories. Page EM-20261031-PYDE created."},{"at":"2026-10-31T03:15:00.000Z","what":"Severity raised to High by C45"},{"at":"2026-10-31T03:15:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-11-03T17:33:48.000Z","what":"Source joined: C26 GitHub Advisory Database"}],"stages":[{"name":"Disclosed","at":"2026-10-28T17:43:40.833Z","detail":"C123 first to name it"},{"name":"Scored","at":"2026-10-28T17:43:40.833Z","detail":"No CVSS yet · EPSS 82.6%"},{"name":"Exploited","at":"2026-10-31T03:15:00.000Z","detail":"C1 CISA KEV, fix by 2026-11-10"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-10-31T03:15:00.000Z","detail":"C45 published"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-10, then 14 quiet days"}],"signals":[{"at":"2026-10-28T17:43:40.833Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497]","text":"investigating. Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Akamai products. Customers and partners can find more det","url":"https://stspg.io/4bgr0nwln15p"},{"at":"2026-10-31T03:15:00.000Z","source":"C45","sourceName":"Palo Alto Networks Security Advisories","role":"Vendor","severity":3,"title":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)","text":null,"url":"https://security.paloaltonetworks.com/CVE-2026-111497"},{"at":"2026-11-03T17:13:54.262Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497]","text":"resolved. As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497). All systems are secured, and we have detected no","url":"https://stspg.io/4bgr0nwln15p"},{"at":"2026-11-03T17:33:48.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-p3jp-9v83-76w9: Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability","text":"nuget:Microsoft.DotNet.ILCompiler, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64, nuget:Mi","url":"https://github.com/advisories/GHSA-p3jp-9v83-76w9"}],"crowd":[],"reference":{"nvd":null,"kev":{"added":"2026-10-27","due":"2026-11-10","ransomware":"Unknown","vendor":"Google","product":"Brotli","name":"Google Brotli Unchecked Return Value Vulnerability"},"epss":{"epss":0.82641,"pct":0.99668,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}