Division of Financial Services
Financial Information Services
<div><strong>Vulnerable Software</strong> | Google Brotli C Decoder<br><strong>Platform(s)</strong> | Anything that ships or links Brotli 1.0.3 through 1.2.0 may be affected<br><strong>Vulnerability Type</strong> | CVSSv4: 9.2<br><strong>Local or Remote Exploitation</strong> | Remote<br><strong>Customer Action – Certified Desktop (Windows/macOS)</strong> | .NET will be patched centrally. Other instances of the vulnerability, such as Node.js, Python HTTP clients, and other software will need to be patched by the endpoint owner.<br><strong>Customer Action – Managed Server</strong> | Customer responsibility to patch<br><strong>Customer Action – Unmanaged </strong> | Customer responsibility to patch<br> </div><div><strong>OVERVIEW: </strong>Security patches have been released for this critical vulnerability, rated CVSS v4.0 Score: 9.2 / Critical. The CVE allows unauthenticated RCE (remote code execution). Many projects ship a private copy of the C decoder instead of using the system's library. A distribution update doesn't fix those: each project has to update its copy. A copy is patched if it includes the new BLOCK_SWITCH error code.</div><div> </div><div><strong>RECOMMENDATIONS: </strong>Apply patches as soon as possible. </div><div><strong> </strong></div><div><strong>SYSTEMS AFFECTED: </strong>Any system running Node.js, Python, or anything else built on Google's C decoder.<strong> </strong></div><div><strong> </strong></div><div><strong>VULNERABILITY MANAGEMENT TOOLS AVAILABLE:</strong></div><div> </div><div>InsightVM - Managed Server Customers</div><div> </div><div>SSO Console login (VPN or on-campus network required) - <a href="https://insightvm-console.security.cornell.edu/">https://insightvm-conso... - <a href="https://insightvm-console.security.cornell.edu:3780/vulnerability/vuln-s... Visual Studio - <a href="https://insightvm-console.security.cornell.edu:3780/vulnerability/vuln-s... vulnerabilities database - <a href="https://www.rapid7.com/db/vulnerabilities/cve-2026-111497/">https://www.... Guide: <a href="https://confluence.cornell.edu/spaces/itsecdocs/pages/429483013/InsightV...…</a></div><div> </div><div><strong>===</strong></div><div> </div><div>Tenable Vulnerability Management - Available to all unit Security Liaisons and designated TSPs</div><div> </div><div>SSO Console login - <a href="https://tenable.security.cornell.edu/">https://tenable.security.cornell.... intelligence overview page: <a href="https://cloud.tenable.com/vm/#/vuln-intelligence/CVE-2026-111497?affecte... query: Explore > Findings: `Tags is equal to [YOUR UNIT TAG] AND Last Seen within last 30 days AND CVE is equal to CVE-2026-111497`</div><div> </div><div>Tenable plugins coverage: <a href="https://www.tenable.com/cve/CVE-2026-111497/plugins">https://www.tenable... FAQ: <a href="https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for...…</a></div><div> </div><div><strong>REFERENCES: </strong></div><div> </div><div><a href="https://nvd.nist.gov/vuln/detail/cve-2026-111497">https://nvd.nist.gov/v...
