Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2023-2026-3334 1 CVE

Important: brotli security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111497: A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 brotli 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 brotli-debuginfo 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 brotli-debugsource 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 brotli-devel 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 libbrotli 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 libbrotli-debuginfo 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 python3-brotli 0:1.1.0-1.amzn2023.0.2
Amazon Linux · 2023 python3-brotli-debuginfo 0:1.1.0-1.amzn2023.0.2

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-111497.html