The Brotli flaw CVE-2026-111497: one library everywhere, in several copies
Brotli is a compression algorithm designed by Google, used everywhere on the web: most browsers accept it, most web servers and CDNs use it to compress pages. A flaw in its decoder, CVE-2026-111497, published on 21 October 2026, allows an out-of-bounds write to a memory buffer when decompressing data crafted for it. This post explains…