Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1076
_____________________________________________________________________

DATE                : 26/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running  brotli (pip) versions prior
                                      to 1.2.1
                    brotlicffi (pip) versions prior to 1.2.1.0.

====================================================================
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
_____________________________________________________________________


Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also
affects the PyPI Brotli package

Critical severity GitHub Reviewed 

Vulnerability details

Package
brotli (pip)

Affected versions
>= 1.0.3, < 1.2.1

Patched versions
1.2.1

brotlicffi (pip)
>= 1.0.3, < 1.2.1.0
1.2.1.0


Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in
Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote
unauthenticated attacker to corrupt adjacent decoder state memory, disclose
sensitive memory contents, cause a denial of service, or potentially
execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through
1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.


References

    https://nvd.nist.gov/vuln/detail/CVE-2026-111497
    https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
    google/brotli@0ed4268
    google/brotli@50a9b70
    google/brotli@b418fa8
    google/brotli@da98063
    https://github.com/google/brotli/releases/tag/v1.0.10
    https://github.com/google/brotli/releases/tag/v1.1.1
    https://github.com/google/brotli/releases/tag/v1.2.1
    https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml
    https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml
    https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
    https://opensourcemalware.com/blog/node2shell-affects-python
    https://pypi.org/project/Brotli
    https://pypi.org/project/brotlicffi
    https://www.cve.org/CVERecord?id=CVE-2026-111497


Severity
Critical
9.2/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality High
Integrity High
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS score

Weaknesses
Weakness CWE-252

CVE ID
No known CVE

GHSA ID
GHSA-9v8h-qqgm-4m35

Source code
google/brotli



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================