Kritik CVSS 9.8 CISA KEV
CVE-2026-111497: Google Brotli: Uzaktan Kod Çalıştırma Riski
Google Brotli 1.0.3-1.2.0 sürümlerinde bir hata var. Saldırgan bu zafiyetle sistemde hata yaratabilir veya kod çalıştırabilir. Hemen en güncel sürümlere (1.0.10, 1.1.1 veya 1.2.1) güncelleyin.
Türkçe özet yapay zekâ ile üretildi.
Açıklama (NVD)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Özet bilgiler
- Ürün
- Google Brotli
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v4.0
- 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS
- %82,64 (yüzdelik 100)
- CWE
- CWE-252
- Yama
- Geçici çözüm
- KEV
- Eklenme: 2026-10-27 · Son tarih: 2026-11-10
Gerekli aksiyon: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| google-brotli | 1.0.3 | — | 1.0.10 |
| google-brotli | 1.1.0 | — | 1.1.1 |
| google-brotli | 1.2.0 | — | 1.2.1 |
| nodejs-node.js | — | — | 22.23.4 |
| nodejs-node.js | 23.0.0 | — | 24.22.1 |
| nodejs-node.js | 25.0.0 | — | 26.12.1 |
| python-hyper-brotlicffi | — | — | 1.2.1.0 |
| microsoft-.net | 8.0.0 | — | 8.0.33 |
| microsoft-.net | 9.0.0 | — | 9.0.22 |
| microsoft-.net | 10.0.0 | — | 10.0.14 |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| microsoft-.net | 11.0.0 | 11.0.0 | — |
| debian-debian-linux | 12.0 | 12.0 | — |
| istio-istio | — | — | 1.29.9 |
| istio-istio | 1.30.0 | — | 1.30.6 |
| istio-istio | 1.31.0 | — | 1.31.2 |
| anthropic-bun | — | — | 1.4.4 |
| envoyproxy-envoy | — | — | 1.37.8 |
| envoyproxy-envoy | 1.38.0 | — | 1.38.6 |
| envoyproxy-envoy | 1.39.0 | — | 1.39.3 |
| tianocore-edk2 | — | 202608 | — |
| google-woff2 | — | — | — |
| duckdb-duckdb | — | 2.0.0 | — |
İlgili haberler
- Node.js ve Brotli Güvenlik Açıkları Cisco Ürünlerini Etkiliyor
- 2nd November – Threat Intelligence Report
- CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
- CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
- AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
- Google security advisory (AV26-1085) - Update 1
- Node2Shell CVEs
Kaynaklar
- NVD kaydı
- github.com
- nodejs.org
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- broccoli2shell.com
- github.com
- github.com
- github.com
- github.com
- github.com
- lists.debian.org
- patchtheplanet.org
- www.aikido.dev
- cert-portal.siemens.com
- cert-portal.siemens.com
- cert-portal.siemens.com
- ellio.tech
- www.cisa.gov
- CWE-252
- CISA KEV kataloğu