Executive Summary
CVE-2026-111497 is a buffer overflow in the Brotli decoder at c/dec/decode.c in Google Brotli 1.0.3 through 1.2.0 that lets a remote unauthenticated attacker corrupt adjacent decoder state memory using a crafted Brotli-compressed stream, enabling memory disclosure, denial of service, or potential code execution. The physical criticality stems from where this decoder lives: not in a single product, but embedded across runtimes, proxies, firmware, and industrial edge platforms that terminate or parse compressed traffic inside OT networks.
Technical Exposure Breakdown
The defect sits in the decompression path. Brotli is a content-encoding format widely negotiated over HTTP and bundled into font loaders, archive tools, and data processing libraries. Because decompression happens before most application logic, an attacker who can deliver a malicious Brotli stream reaches vulnerable code without authentication. The attack vector is the compressed payload itself, which means any component that accepts Content-Encoding: br, parses WOFF2 fonts, or ingests Brotli-framed data is a candidate for exploitation.
The exposure in the grounding data is broad. Google Brotli is vulnerable in ranges 1.0.3 to 1.0.10, 1.1.0 to 1.1.1, and 1.2.0 to 1.2.1. The decoder flaw propagates downstream into Node.js (ranges up to 22.23.4, 23.0.0 to 24.22.1, and 25.0.0 to 26.12.1), Microsoft .NET (8.0.0 to 8.0.33, 9.0.0 to 9.0.22, 10.0.0 to 10.0.14), Envoy (up to 1.37.8, 1.38.0 to 1.38.6, 1.39.0 to 1.39.3), and Istio (up to 1.29.9, 1.30.0 to 1.30.6, 1.31.0 to 1.31.2). Data tooling is also listed: DuckDB up to 2.0.0, ClickHouse up to 26.10.2.103, and Apache Arrow up to 26.0.0. Firmware and edge platforms appear in the grounding data as affected Siemens entries, including RUGGEDCOM APE1808 firmware and multiple Industrial Edge configurator and management components, though specific fixed versions are not stated in the grounding data and should not be assumed.
The pattern that matters for OT teams is that Brotli is a transitive dependency. Operators rarely install Brotli directly. They install an HMI runtime, a historian, a protocol gateway, or an edge orchestrator that statically links or vendors the decoder. Asset inventories keyed on top-level product names will miss it.
OT Impact and Compliance Risk
Physically, the immediate risk is denial of service. A proxy like Envoy or an edge databus component that crashes on a crafted stream can sever telemetry, block operator visibility, or interrupt a control loop that depends on the data path staying up. Memory disclosure raises the prospect of leaked session material or configuration from devices that sit between IT and the process network. Code execution potential on an edge platform or managed firmware is the worst case, because that foothold straddles the Purdue boundary.
For compliance, this touches IEC 62443-4-1 secure development expectations and 62443-3-3 system hardening, since an unauthenticated network-reachable flaw undermines zone and conduit assumptions. NERC CIP-007 patch management and CIP-010 configuration monitoring apply to any in-scope BES Cyber System running an affected runtime. Pipeline operators under TSA SD-02C must account for this in their patch and segmentation justifications, and water utilities covered by AWIA 2018 should fold it into risk and resilience reviews where affected components front SCADA interfaces.
Compensating Controls
Do not rely on active scanning to find this. Probing industrial endpoints with crafted compression payloads can corrupt decoder state and crash the very devices you are trying to assess. Build the inventory from vendor SBOMs and dependency manifests instead.
- Strip or reject Brotli content-encoding at the conduit boundary where it is not operationally required. If a device does not need
Content-Encoding: br, deny it upstream. - Deploy a virtual patch at the segmentation layer. A Suricata rule concept: alert on HTTP responses or payloads carrying
content-encoding: brtraversing into OT zones from untrusted sources, and drop Brotli-framed data on conduits where it has no legitimate function. - Rate-limit and restrict which hosts can deliver compressed streams to edge platforms and gateways, tightening the attacker's reach even before patching.
- Prioritize remediation on internet-adjacent proxies and edge orchestrators over deeply isolated controllers, based on actual reachability rather than CVSS alone.
BreachSpider's AI analysis labels this as a transitive dependency exposure; specific fixed versions for firmware and edge components are not confirmed in our current grounding data and should be verified against vendor advisories before deployment.
BreachSpider Intel
BreachSpider tracks CVE-2026-111497 across the affected runtime, proxy, and firmware supply chain so OT teams can map transitive Brotli exposure without active probing.