{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111497", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2026-10-16T09:58:17.790Z", "datePublished": "2026-10-22T13:35:41.975Z", "dateUpdated": "2026-10-30T18:31:38.139Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2026-10-27T14:58:42.704Z"}, "title": "Out-of-Bounds Write in Google Brotli Decoder", "datePublic": "2026-02-27T07:50:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-252", "description": "CWE-252 Unchecked Return Value", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "Google", "product": "Brotli", "packageName": "github.com/google/brotli", "repo": "https://github.com/google/brotli", "versions": [{"status": "affected", "version": "1.0.3", "lessThan": "1.0.10", "versionType": "semver"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.1", "versionType": "semver"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A buffer overflow vulnerability in the Brotli decoder (<code>c/dec/decode.c</code>) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.<br><br></p><p>Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.<span></span></p>"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "tags": ["patch"]}, {"url": "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "tags": ["release-notes", "third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}]}], "credits": [{"lang": "en", "value": "OpenAI Codex Security - Khai Tran and Sylvie Mayer", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}, "x_gcve": [{"vulnId": "CVE-2026-111497", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-23T00:00:00+00:00", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-111497"}}}], "references": [{"url": "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "tags": ["third-party-advisory"]}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "tags": ["government-resource"]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T03:55:48.896Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-26T18:10:34.928Z"}, "references": [{"url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/23/25"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/24/6"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/26/12"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/26/13"}, {"url": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"}, {"url": "https://broccoli2shell.com"}, {"url": "https://github.com/dotnet/announcements/issues/494"}, {"url": "https://github.com/google/brotli/releases/tag/v1.2.1"}, {"url": "https://github.com/google/brotli/releases/tag/v1.1.1"}, {"url": "https://github.com/google/brotli/releases/tag/v1.0.10"}, {"url": "https://patchtheplanet.org/brotli"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/26/16"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-30T18:31:38.139Z"}, "affected": [{"vendor": "Siemens", "product": "Heliox Dual Port 60kW", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Heliox Flex Pro", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SICHARGE FLEX", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SICHARGE UC", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Sifinity Go", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Sifinity Setup", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "VersiCharge AC Series", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "VersiCloud", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Cloud Connector Configurator", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Common Configurator\u00a0(CC on IEM)", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Common Configurator on Device\u00a0(CC on Edge)", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Data Flow Monitoring", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Databus Configurator", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Edge OPC UA Server Configurator", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Flow Creator Configurator", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Industrial Edge Hub", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Industrial Edge Management Cloud", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM APE1808", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-898633.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-443410.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-045512.html"}]}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-111497", "date": "2026-11-01", "epss": "0.82641", "percentile": "0.99666"}, "microsoft_vex": {"current_release_date": "2026-10-26T07:00:00.000Z", "cve": "CVE-2026-111497", "id": "msrc_CVE-2026-111497", "initial_release_date": "2026-10-25T07:00:00.000Z", "product_status:fixed": "21", "product_status:known_affected": "21", "source": "Microsoft CSAF VEX", "status": "final", "title": "Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder", "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-111497.json", "version": "2"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-111497\",\"sourceIdentifier\":\"cve-coordination@google.com\",\"published\":\"2026-10-22T14:17:37.190\",\"lastModified\":\"2026-10-30T20:30:11.670\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\\n\\n\\n\\n\\n\\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\"}],\"affected\":[{\"source\":\"cve-coordination@google.com\",\"affectedData\":[{\"vendor\":\"Google\",\"product\":\"Brotli\",\"defaultStatus\":\"unaffected\",\"packageName\":\"github.com/google/brotli\",\"repo\":\"https://github.com/google/brotli\",\"versions\":[{\"version\":\"1.0.3\",\"lessThan\":\"1.0.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.1.0\",\"lessThan\":\"1.1.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.2.0\",\"lessThan\":\"1.2.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"Heliox Dual Port 60kW\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Heliox Flex Pro\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SICHARGE FLEX\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SICHARGE UC\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Sifinity Go\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Sifinity Setup\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"VersiCharge AC Series\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"VersiCloud\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Cloud Connector Configurator\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Common Configurator\u00a0(CC on IEM)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Common Configurator on Device\u00a0(CC on Edge)\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Data Flow Monitoring\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Databus Configurator\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Edge OPC UA Server Configurator\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Flow Creator Configurator\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Hub\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Cloud\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM APE1808\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-10-23T00:00:00+00:00\",\"id\":\"CVE-2026-111497\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2026-10-27\",\"cisaActionDue\":\"2026-11-10\",\"cisaRequiredAction\":\"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\",\"cisaVulnerabilityName\":\"Google Brotli Unchecked Return Value Vulnerability\",\"weaknesses\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-252\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"1.0.3\",\"versionEndExcluding\":\"1.0.10\",\"matchCriteriaId\":\"8A7BE60F-21B0-4779-8D59-6E5E58C5826B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndExcluding\":\"1.1.1\",\"matchCriteriaId\":\"48E72297-AFBD-4460-A732-5A6803CCCDB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*\",\"versionStartIncluding\":\"1.2.0\",\"versionEndExcluding\":\"1.2.1\",\"matchCriteriaId\":\"C8CA5C74-26A8-44E3-B893-1FA01CED49F5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"22.23.4\",\"matchCriteriaId\":\"02348F18-5E17-4427-8B78-63B4082F2FB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"23.0.0\",\"versionEndExcluding\":\"24.22.1\",\"matchCriteriaId\":\"852D09BB-A396-4813-81C9-7D89D5DD5FB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"25.0.0\",\"versionEndExcluding\":\"26.12.1\",\"matchCriteriaId\":\"219CA855-3A40-42CE-BAB6-79CCFEE7746F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*\",\"versionEndExcluding\":\"1.2.1.0\",\"matchCriteriaId\":\"E732E75B-4BEF-4D7E-8520-E03B707FB4F6\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.0.33\",\"matchCriteriaId\":\"65DCE51C-2CD9-4179-9354-5323D28573AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.0.22\",\"matchCriteriaId\":\"98654489-8C4E-4801-8728-29B01A22DEED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.14\",\"matchCriteriaId\":\"27DF5CF4-58E3-4F01-A3AA-D44B7DCC3D67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DACF2FE-CF61-43E4-8A3F-F7A358DE8A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*\",\"matchCriteriaId\":\"280B2E64-3163-40AB-A048-14D58DEC42FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*\",\"matchCriteriaId\":\"12357908-3294-46EF-85A0-DA3F86C97489\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*\",\"matchCriteriaId\":\"849FC8F5-86CD-4B5D-ADFD-9CB16EA75D09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*\",\"matchCriteriaId\":\"C86E87E2-B236-4AC9-B6C3-64B9CDEC91EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B14656E-2BB0-4B4B-B518-F3D5108253ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E09C9DB3-F42C-4442-9CF0-24A780D094C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"67035E86-61F5-421E-B243-EF64458AD8BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C46300CA-BA84-48B3-85C5-C20CB487C733\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46D69DCC-AE4D-4EA5-861C-D60951444C6C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.29.9\",\"matchCriteriaId\":\"9F01FA9D-7190-431F-84DD-24D4EBC41A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.30.0\",\"versionEndExcluding\":\"1.30.6\",\"matchCriteriaId\":\"B8DE25CE-AFCB-4685-9836-B8EC9C820975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.31.0\",\"versionEndExcluding\":\"1.31.2\",\"matchCriteriaId\":\"55EBE231-2EB8-4C9C-B279-D07F82EA5B55\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.4\",\"matchCriteriaId\":\"51DD72B3-85F6-4B10-AEB4-41E0679ED0AA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.37.8\",\"matchCriteriaId\":\"8EE6278D-A48A-427C-8A7E-1D4103E2ADF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.38.0\",\"versionEndExcluding\":\"1.38.6\",\"matchCriteriaId\":\"CDCA301F-83CA-4DDB-AAE4-24D5235EE2D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.39.0\",\"versionEndExcluding\":\"1.39.3\",\"matchCriteriaId\":\"B9A47DD3-2655-4722-9B9D-3888B590C82F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"202608\",\"matchCriteriaId\":\"C4CFCBFB-4A38-481B-93AE-7D86CCDC6FB5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D1FC23A-20F7-48F7-ABB8-8D37903DFB58\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.0.0\",\"matchCriteriaId\":\"0DFA4F95-92F9-4369-BE42-387520F0765B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.10.2.103\",\"matchCriteriaId\":\"B40EE389-E2AC-4D86-91B2-79A895470317\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.0.0\",\"matchCriteriaId\":\"46A78CA5-1E4A-4DAA-B40D-387B96C1E2F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*\",\"matchCriteriaId\":\"130A7077-7885-43CB-8AFF-B6056D380156\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.02-1.5.7-r2\",\"matchCriteriaId\":\"FB91A353-9BE9-49E7-86FD-6B5FBB291351\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"16.02\",\"matchCriteriaId\":\"76A26292-08BE-459A-B25A-CA14AF8D3C29\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"1.2.7\",\"matchCriteriaId\":\"F3E50F12-AEFE-4B4F-B474-3676F145E032\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37FDCA69-9049-40B4-88AF-F476901022B6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B89A6863-B602-4404-8D26-337FECABFFF0\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F93AD0A-C29E-4FA6-A18B-1F0D03CC900C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"508960FA-9D4A-4D2A-AAD7-7B7F4F0A7718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13D7B958-EEB6-422A-9C04-5DE59EC9CA11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C869C4D8-EF92-4256-8347-119B413A5554\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"689172E8-3F11-4E87-852E-846F583D2E4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2A6C3C9-3BC3-434B-92C0-5A4B3CC1E30C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70BA5718-0A9F-4B7D-9175-D6719B795363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EA7E869-9428-4D5E-95C0-F19B6BC1BFA9\"}]}]}],\"references\":[{\"url\":\"https://github.com/andybalholm/brotli/releases/tag/v1.2.7\",\"source\":\"cve-coordination@google.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high\",\"source\":\"cve-coordination@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/23/25\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/24/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/26/12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/26/13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/26/16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://broccoli2shell.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/advisories/GHSA-9v8h-qqgm-4m35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/dotnet/announcements/issues/494\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/google/brotli/releases/tag/v1.0.10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/google/brotli/releases/tag/v1.1.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/google/brotli/releases/tag/v1.2.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://patchtheplanet.org/brotli\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-045512.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-443410.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-898633.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}", "redhat_vex": {"aggregate_severity": "Important", "current_release_date": "2026-11-02T03:38:33+00:00", "cve": "CVE-2026-111497", "id": "CVE-2026-111497", "initial_release_date": "2026-10-22T13:35:41.975000+00:00", "product_status:fixed": "1338", "product_status:known_affected": "27", "product_status:known_not_affected": "533", "product_status:under_investigation": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/advisories/GHSA-9v8h-qqgm-4m35\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/23/25\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/24/6\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/26/12\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/26/13\"}, {\"url\": \"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497\"}, {\"url\": \"https://broccoli2shell.com\"}, {\"url\": \"https://github.com/dotnet/announcements/issues/494\"}, {\"url\": \"https://github.com/google/brotli/releases/tag/v1.2.1\"}, {\"url\": \"https://github.com/google/brotli/releases/tag/v1.1.1\"}, {\"url\": \"https://github.com/google/brotli/releases/tag/v1.0.10\"}, {\"url\": \"https://patchtheplanet.org/brotli\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/26/16\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-10-26T18:10:34.928Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"Heliox Dual Port 60kW\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Heliox Flex Pro\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SICHARGE FLEX\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SICHARGE UC\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Sifinity Go\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Sifinity Setup\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"VersiCharge AC Series\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"VersiCloud\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Cloud Connector Configurator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Common Configurator\\u00a0(CC on IEM)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Common Configurator on Device\\u00a0(CC on Edge)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Data Flow Monitoring\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Databus Configurator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Edge OPC UA Server Configurator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Flow Creator Configurator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Industrial Edge Hub\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Industrial Edge Management Cloud\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM APE1808\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-898633.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-443410.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-045512.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-10-30T18:31:38.139Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-111497\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-27T19:53:21.238552Z\"}}}], \"references\": [{\"url\": \"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-22T19:00:18.440Z\"}}], \"cna\": {\"title\": \"Out-of-Bounds Write in Google Brotli Decoder\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"OpenAI Codex Security - Khai Tran and Sylvie Mayer\"}], \"impacts\": [{\"capecId\": \"CAPEC-100\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-100 Overflow Buffers\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/google/brotli\", \"vendor\": \"Google\", \"product\": \"Brotli\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.3\", \"lessThan\": \"1.0.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.1.0\", \"lessThan\": \"1.1.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.2.0\", \"lessThan\": \"1.2.1\", \"versionType\": \"semver\"}], \"packageName\": \"github.com/google/brotli\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\", \"base64\": false}]}], \"datePublic\": \"2026-02-27T07:50:00.000Z\", \"references\": [{\"url\": \"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/andybalholm/brotli/releases/tag/v1.2.7\", \"tags\": [\"release-notes\", \"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\\n\\n\\n\\n\\n\\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>A buffer overflow vulnerability in the Brotli decoder (<code>c/dec/decode.c</code>) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.<br><br></p><p>Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.<span></span></p>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-252\", \"description\": \"CWE-252 Unchecked Return Value\"}]}], \"providerMetadata\": {\"orgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"shortName\": \"Google\", \"dateUpdated\": \"2026-10-27T14:58:42.704Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-111497\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T18:31:38.139Z\", \"dateReserved\": \"2026-10-16T09:58:17.790Z\", \"assignerOrgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"datePublished\": \"2026-10-22T13:35:41.975Z\", \"assignerShortName\": \"Google\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}