Google Brotli decoder memory corruption flaw

A compression part can be broken by crafted data, letting servers or apps be hacked or stalled!

Summary

A memory write flaw in the Google Brotli decoder lets an unauthenticated remote attacker send crafted compressed data to read memory, crash a service or run code. Versions 1.0.3 through 1.2.0 on all platforms are affected, and a WordPress pingback request can also crash PHP workers.

Affected when

programs that decode Brotli-compressed data from outside sources

What to do

Update to Brotli 1.0.10, 1.1.1 or 1.2.1. If you use a Linux distribution package, install its Brotli security update. Until then, close the xmlrpc.php pingback route in WordPress.

Update to at least the version for your product:

Google Brotli 1.0.x 1.0.10 or later
Google Brotli 1.1.x 1.1.1 or later
Google Brotli 1.2.x 1.2.1 or later

Products and platforms

Windows
macOS
Linux
Android
iOS
Google Brotli

CVE IDs

CVE-2026-111497 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab)
Write-up: hatamoto.dev (opens in a new tab) · ellio.tech (opens in a new tab)
CVE record: cve.org (opens in a new tab)
Discussion: Brotli CVE-2026-111497 reaches stock WordPress through pingbacks (opens in a new tab)

Times

First published 2026-10-22 13:35 UTC

First seen 2026-11-09 12:16 UTC