Skip to content
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions

Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions

First seen 28 Oct 2026, 07:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 07:49 UTC
  • •CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Brotli decoder.
  • •Active exploitation of this vulnerability has been confirmed, prompting urgent updates.
  • •Multiple Linux distributions, including Fedora and Oracle, have released patches.

A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026, and was added to the CISA KEV list due to being confirmed on October 27, 2026. Affected versions include Brotli 1.1.0 and earlier for Oracle Linux and Brotli 1.2.1 for Fedora. Users are urged to update their systems immediately to mitigate risks. The updates can be installed via the respective package management systems. The flaw has a CVSS score of 9.2, indicating its nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
CVE-2026-111497 published
A critical vulnerability in the Brotli decoder was disclosed, allowing for potential code execution.
Linuxsecurity
2026-10-26
Patches released for Fedora and Oracle
Fedora 44 and Oracle Linux 10 released updates to fix the out-of-bounds write vulnerability in Brotli.
Linuxsecurity
2026-10-27
CISA adds CVE-2026-111497 to KEV
CISA confirmed active exploitation of the Brotli decoder vulnerability, prompting immediate action.
Linuxsecurity

More articles in this cluster (5)

Following this threat?

Track Fedora and CVE-2026-111497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which Linux distributions are affected?
Fedora 44 and Oracle Linux 10 are among the affected distributions, specifically versions using Brotli 1.1.0 and earlier.
How urgent is the patching process?
Patching is urgent due to confirmed active exploitation of the vulnerability, which has a CVSS score of 9.2.
What steps should I take to patch?
Users should immediately update their systems using the package management tools provided by their distribution.