CVE-2026-111497 in Brotli: dependent projects need inventory and fixes

What happened and what to do

The post on the oss-sec list, published by Alan Coopersmith on 25 October 2026, covers CVE-2026-111497 affecting Brotli, a compression library. The message expands the list of projects that include Brotli, among them .NET runtime, Apache Arrow, Chromium, ClickHouse, DuckDB, Firefox, Ghostscript, MuPDF, ngx_brotli, p7zip, woff2, and several language bindings for Ruby, PHP and Java. According to the author, some of these projects have already fixed the problem, and the status of the others still needs confirmation.

For a company, the case first calls for an inventory: identify which applications, container images, packages and internal libraries use Brotli, directly or indirectly, including transitive dependencies. With that map, installed versions can be compared with the fixes published by each project and the status of each component recorded. This check can be automated with periodic SBOM collection, queries to advisory sources and a dashboard showing exposure by service, priority and owner. In environments with many services, it also helps to create an update flow that opens tickets automatically when a fixed version of an component in use is released.

How the consultancy can help

Diagnosis of your exposure to CVE-2026-111497, with a survey of direct and transitive dependencies in applications and images. Then a scoped implementation: SBOM collection, matching against advisories, an exposure dashboard by service and a monitored update flow.

Next step

If your company uses Brotli or components that include it, send a short description of your environment, such as languages, services and deployment model. You will receive a scoped proposal for the diagnosis and remediation.