{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-111497","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-23T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-28T03:55:48.896Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-11-03T21:05:46.791Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25"},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13"},{"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"},{"url":"https://broccoli2shell.com"},{"url":"https://github.com/dotnet/announcements/issues/494"},{"url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"url":"https://github.com/google/brotli/releases/tag/v1.1.1"},{"url":"https://github.com/google/brotli/releases/tag/v1.0.10"},{"url":"https://patchtheplanet.org/brotli"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/16"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/03/2"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}},{"affected":[{"defaultStatus":"unknown","product":"Desigo CC family V8","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Desigo CC family V9","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Heliox Dual Port 60kW","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Heliox Flex Pro","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SICHARGE FLEX","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SICHARGE UC","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Sifinity Go","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Sifinity Setup","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"VersiCharge AC Series","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"VersiCloud","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Cloud Connector Configurator","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Common Configurator (CC on IEM)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Common Configurator on Device (CC on Edge)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Data Flow Monitoring","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Databus Configurator","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Edge OPC UA Server Configurator","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Flow Creator Configurator","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Hub","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Cloud","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM APE1808","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-11-04T17:47:42.136Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-898633.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-443410.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-045512.html"}],"x_adpType":"supplier"},{"affected":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:yjh0502:erl-brotli:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["brotli_nif","brotli_decoder","brotli"],"packageName":"brotli","packageURL":"pkg:hex/brotli","product":"erl-brotli","programFiles":["c_src/dec/decode.c","c_src/brotli_nif.c","src/brotli_nif.erl","src/brotli_decoder.erl","src/brotli.erl"],"programRoutines":[{"name":"DecodeBlockTypeAndLength"},{"name":"DecodeLiteralBlockSwitch"},{"name":"DecodeCommandBlockSwitch"},{"name":"DecodeDistanceBlockSwitch"},{"name":"BrotliDecoderDecompressStream"},{"name":"brotli_decoder_decompress_stream"},{"name":"brotli_nif:decoder_decompress_stream/2"},{"name":"brotli_decoder:stream/2"},{"name":"brotli:decode/1"},{"name":"brotli:decode/2"}],"repo":"https://github.com/yjh0502/erl-brotli","vendor":"yjh0502","versions":[{"lessThan":"0.3.4","status":"affected","version":"0.3.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:yjh0502:erl-brotli:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["brotli_nif","brotli_decoder","brotli"],"packageName":"yjh0502/erl-brotli","packageURL":"pkg:github/yjh0502/erl-brotli","product":"erl-brotli","programFiles":["c_src/dec/decode.c","c_src/brotli_nif.c","src/brotli_nif.erl","src/brotli_decoder.erl","src/brotli.erl"],"programRoutines":[{"name":"DecodeBlockTypeAndLength"},{"name":"DecodeLiteralBlockSwitch"},{"name":"DecodeCommandBlockSwitch"},{"name":"DecodeDistanceBlockSwitch"},{"name":"BrotliDecoderDecompressStream"},{"name":"brotli_decoder_decompress_stream"},{"name":"brotli_nif:decoder_decompress_stream/2"},{"name":"brotli_decoder:stream/2"},{"name":"brotli:decode/1"},{"name":"brotli:decode/2"}],"repo":"https://github.com/yjh0502/erl-brotli","vendor":"yjh0502","versions":[{"lessThan":"7498e1c743c71a99636e8f897b6b016433830d6d","status":"affected","version":"1e2af9bebba40ee292abf51e19ac831c2658ca47","versionType":"git"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:yjh0502:erl-brotli:*:*:*:*:*:*:*:*","versionEndExcluding":"0.3.4","versionStartIncluding":"0.3.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"reporter","value":"liamwhite"},{"lang":"en","type":"remediation developer","value":"Łukasz Jan Niemier"},{"lang":"en","type":"reporter","value":"Łukasz Jan Niemier"},{"lang":"en","type":"coordinator","value":"Jonatan Männchen / EEF"}],"datePublic":"2026-11-05T19:58:04Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to <code>brotli:decode/1</code> to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.</p>\n<p>erl-brotli compiles its own copy of the Google Brotli C sources under <code>c_src</code> into a NIF, and <code>brotli_decoder_decompress_stream</code> in <code>c_src/brotli_nif.c</code> hands the input to <code>BrotliDecoderDecompressStream</code>. In <code>c_src/dec/decode.c</code>, <code>DecodeBlockTypeAndLength</code> returns false for a block switch in a category with at most one block type, and the non-streaming callers <code>DecodeLiteralBlockSwitch</code>, <code>DecodeCommandBlockSwitch</code> and <code>DecodeDistanceBlockSwitch</code> discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.</p>\n<p>This issue affects brotli: from 0.3.0 before 0.3.4.</p>"},{"base64":false,"type":"text/markdown","value":"Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to `brotli:decode/1` to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.\n\nerl-brotli compiles its own copy of the Google Brotli C sources under `c_src` into a NIF, and `brotli_decoder_decompress_stream` in `c_src/brotli_nif.c` hands the input to `BrotliDecoderDecompressStream`. In `c_src/dec/decode.c`, `DecodeBlockTypeAndLength` returns false for a block switch in a category with at most one block type, and the non-streaming callers `DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch` and `DecodeDistanceBlockSwitch` discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.\n\nThis issue affects brotli: from 0.3.0 before 0.3.4."}],"value":"Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.\n\nerl-brotli compiles its own copy of the Google Brotli C sources under c_src into a NIF, and brotli_decoder_decompress_stream in c_src/brotli_nif.c hands the input to BrotliDecoderDecompressStream. In c_src/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.\n\nThis issue affects brotli: from 0.3.0 before 0.3.4."}],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses <code>Content-Encoding: br</code> responses with this package, can crash the Erlang VM and potentially run code inside it.</p>"},{"base64":false,"type":"text/markdown","value":"An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses `Content-Encoding: br` responses with this package, can crash the Erlang VM and potentially run code inside it."}],"value":"An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it."}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787 Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T20:00:10.831Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"name":"Update Brotli to v1.2.1","tags":["issue-tracking","related"],"url":"https://github.com/yjh0502/erl-brotli/issues/23"},{"name":"EEF CNA record for CVE-2026-111497","tags":["related","third-party-advisory"],"url":"https://cna.erlef.org/cves/CVE-2026-111497.html"},{"name":"OSV record EEF-CVE-2026-111497","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-111497"},{"name":"erl-brotli v0.3.4 release notes","tags":["release-notes","related"],"url":"https://github.com/yjh0502/erl-brotli/releases/tag/v0.3.4"},{"name":"Introducing commit 1e2af9b in yjh0502/erl-brotli","tags":["related"],"url":"https://github.com/yjh0502/erl-brotli/commit/1e2af9bebba40ee292abf51e19ac831c2658ca47"},{"name":"Fix commit 7498e1c in yjh0502/erl-brotli","tags":["patch"],"url":"https://github.com/yjh0502/erl-brotli/commit/7498e1c743c71a99636e8f897b6b016433830d6d"}],"source":{"discovery":"EXTERNAL"},"title":"Out-of-bounds write in the Brotli decoder bundled with erl-brotli"}],"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"github.com/google/brotli","product":"Brotli","repo":"https://github.com/google/brotli","vendor":"Google","versions":[{"lessThan":"1.0.10","status":"affected","version":"1.0.3","versionType":"semver"},{"lessThan":"1.1.1","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThan":"1.2.1","status":"affected","version":"1.2.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"OpenAI Codex Security - Khai Tran and Sylvie Mayer"}],"datePublic":"2026-02-27T07:50:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>A buffer overflow vulnerability in the Brotli decoder (<code>c/dec/decode.c</code>) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.<br><br></p><p>Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.<span></span></p>"}],"value":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787 Out-of-bounds Write","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-252","description":"CWE-252 Unchecked Return Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-27T14:58:42.704Z","orgId":"14ed7db2-1595-443d-9d34-6215bf890778","shortName":"Google"},"references":[{"tags":["patch"],"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"tags":["release-notes","third-party-advisory"],"url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}],"value":"Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}],"source":{"discovery":"EXTERNAL"},"title":"Out-of-Bounds Write in Google Brotli Decoder","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"14ed7db2-1595-443d-9d34-6215bf890778","assignerShortName":"Google","cveId":"CVE-2026-111497","datePublished":"2026-10-22T13:35:41.975Z","dateReserved":"2026-10-16T09:58:17.790Z","dateUpdated":"2026-11-05T20:00:10.831Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}