investigation
A CVE-2026-111497 vulnerability was identified in Google's Brotli data compression library.
A investigation by Turan Security Xavfsizlik Byulleteni. Statements are as reported by the cited publishers — not verified by DecisionGateway.
Google Brotli ma’lumotlarni siqish kutubxonasida CVE-2026-111497 zaifligi aniqlandi.
Related claims
The vulnerability affects some systems that use Brotli and brotlicffi libraries in Node.js, Bun, Envoy, Istio and Python.Turan Security Xavfsizlik Byulleteni · statementTuran Security calls on organizations to inventory Brotli-dependent components, strengthen monitoring, and not delay security updates.Turan Security · commitmentAn application may not call Brotli directly; reading a 'Content-Encoding: br' response or decompressing a Brotli-compressed request body is enough.Turan Security Xavfsizlik Byulleteni · statementA critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in GitLab CE/EE systems.Turan Security xavfsizlik byulleteni · investigationOrganizations should inventory Brotli versions in Node.js, Bun, Envoy, Istio and Python environments, since updating the runtime is not always sufficient and separate Brotli libraries inside the application should also be checked.Turan Security Xavfsizlik Byulleteni · commitmentExploit code has not yet been distributed, but the CVE is confirmed.turansecurity · statement