CVE-2026-111497
Google Brotli Unchecked Return Value Vulnerability
CRITICAL / 緊急● 悪用確認済み（CISA KEV）
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
影響製品・バージョン
- google brotli >= 1.0.3, < 1.0.10
- google brotli >= 1.1.0, < 1.1.1
- google brotli >= 1.2.0, < 1.2.1
- nodejs node.js < 22.23.4
- nodejs node.js >= 23.0.0, < 24.22.1
- nodejs node.js >= 25.0.0, < 26.12.1
- python-hyper brotlicffi < 1.2.1.0
- microsoft .net >= 8.0.0, < 8.0.33
- microsoft .net >= 9.0.0, < 9.0.22
- microsoft .net >= 10.0.0, < 10.0.14
- microsoft .net 11.0.0
- debian debian linux 12.0
- istio istio < 1.29.9
- istio istio >= 1.30.0, < 1.30.6
- istio istio >= 1.31.0, < 1.31.2
- anthropic bun < 1.4.4
- envoyproxy envoy < 1.37.8
- envoyproxy envoy >= 1.38.0, < 1.38.6
- envoyproxy envoy >= 1.39.0, < 1.39.3
- tianocore edk2 <= 202608
- google woff2
- duckdb duckdb <= 2.0.0
- clickhouse clickhouse <= 26.10.2.103
- apache arrow <= 26.0.0
- apache arrow 27.0.0
- mcmilk 7-zip-zstd <= 26.02-1.5.7-r2
- 7-zip p7zip <= 16.02
- andybalholm brotli < 1.2.7
- siemens ruggedcom ape1808 firmware
- siemens common configurator
- siemens data flow monitoring
- siemens edge opc ua server configurator
- siemens flow creator configurator
- siemens industrial edge cloud connector configurator
- siemens industrial edge databus configurator
- siemens industrial edge hub
- siemens industrial edge management cloud
修正バージョン
- 1.0.10
- 1.1.1
- 1.2.1
- 22.23.4
- 24.22.1
- 26.12.1
- 1.2.1.0
- 8.0.33
- 9.0.22
- 10.0.14
- 1.29.9
- 1.30.6
- 1.31.2
- 1.4.4
- 1.37.8
- 1.38.6
- 1.39.3
- 1.2.7
対応策
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
参考資料
- Known Exploited Vulnerabilities CatalogCISA公開日: 不明公的機関一次情報取得日: 2026-10-31
関連インシデント
この脆弱性に関連付けられた登録インシデントはありません。