Brotli2Shell: Critical RCE in Google Brotli Decoder Demands Immediate Patching
CVE-2026-111497, a CVSS 9.2-rated out-of-bounds write vulnerability in Google's Brotli decoder library, enables remote code execution and memory leaks simply by processing attacker-controlled compressed data — a capability present in an enormous number of applications and runtimes. The core problem is that Brotli is deeply embedded in ecosystems like Node.js and .NET, and many applications bundle their own private copies of the library, meaning a single upstream patch does not automatically protect every dependent application. This supply-chain-style distribution of the vulnerable component dramatically widens the attack surface and complicates remediation. Organizations that lack a complete software bill of materials (SBOM) or automated dependency tracking will struggle to identify every affected asset before attackers exploit them.
Tactical Insight
Immediate actions
- Apply available patches for Google Brotli, Node.js, and .NET immediately, prioritising internet-facing and data-processing services.
- Audit all application codebases and container images for vendored or statically linked copies of the Brotli library that will not be updated by runtime-level patches.
- Where patching is not immediately possible, restrict or disable decompression of Brotli-encoded data from untrusted sources as a temporary compensating control.
Long-term improvements
- Generate and maintain a Software Bill of Materials (SBOM) for every application so bundled third-party libraries can be identified and patched systematically.
- Integrate Software Composition Analysis (SCA) tooling into CI/CD pipelines to automatically flag vulnerable third-party components before code ships to production.
- Establish a formal emergency patching SLA (e.g., ≤72 hours for CVSS ≥9.0 findings) backed by tested runbooks.
Detection measures
- Deploy runtime application self-protection (RASP) or memory-safety monitoring to detect exploitation attempts such as out-of-bounds writes and unexpected memory dumps.
- Monitor application logs and network telemetry for anomalous decompression activity, unexpected process spawning, or unusual outbound connections that may indicate post-exploitation.