Brotli decoder CVE-2026-111497 enables RCE in Bun, Python, and Envoy
1. Executive summary An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) has been rated CVSS 9.2, critical, and affects
24 Oct 2026 · 6 min read
read →