Summary
CVE-2026-111497 is a critical out-of-bounds write in the decoder of the Google Brotli compression library. A remote, unauthenticated attacker who can make an application decompress a crafted Brotli stream may corrupt memory, leading to denial of service, memory disclosure, or possibly arbitrary code execution. HYCU products use the vulnerable library, but never use its vulnerable decoding path, so exploitation is unlikely.
Date of publication
October 29th 2026
Description
The following vulnerability is in scope of this advisory:
- CVE-2026-111497 (CVSS v4.0 9.2, Red Hat rating Important, CVSS v3.1 8.1): The Brotli decoder (`c/dec/decode.c`) does not check a return value and can write past the end of a buffer while decoding a malformed stream, corrupting adjacent decoder state. Exploitation is reported as active.
Affected upstream versions are Brotli 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. Fixed upstream versions are 1.0.10, 1.1.1, and 1.2.1. Applications that bundle their own copy of Brotli may be affected independently of the system library.
Impact
HYCU has performed a security analysis and determined the HYCU products include packages that contain the vulnerable Brotli library, but the vulnerable decoding path is never used. Exploitation of this vulnerability in HYCU products is therefore unlikely.
Mitigation
No customer action is required.
HYCU will provide a security update for HYCU R-Cloud and HYCU R-Cloud HCE in the timeframe as specified in the security policy.
Reference
- NVD link https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- Red Hat CVE page https://access.redhat.com/security/cve/CVE-2026-111497
- Red Hat security bulletin https://access.redhat.com/security/vulnerabilities/RHSB-2026-015
Comments
Please sign in to leave a comment.