- Exploited
- No known exploitation
- Fix
- Fixed in 0.3.4
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 0.3.4.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 10/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The bundled Brotli decoder in the erl-brotli Erlang package has an out-of-bounds write flaw that an attacker can trigger by supplying a crafted Brotli-compressed stream to `brotli:decode/1`. Successful exploitation can corrupt decoder memory, disclose memory contents, crash the entire Erlang VM, or potentially execute code, because the decoder runs inside a native extension.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.
erl-brotli compiles its own copy of the Google Brotli C sources under c_src into a NIF, and brotli_decoder_decompress_stream in c_src/brotli_nif.c hands the input to BrotliDecoderDecompressStream. In c_src/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.
This issue affects brotli: from 0.3.0 before 0.3.4.
Impact
An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Affects Hex packages
- Severity?/10Unknown. No CVSS score or vendor rating
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 32 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 0.3.4.
Timeline
- Advisory published15 days
- Record last updated
Affected versions
- brotliHex
From 0.3.0 · fixed in 0.3.4
Evidence 6
- Patch
- Repository
- Repository
- Repository
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about EEF-CVE-2026-111497
Is EEF-CVE-2026-111497 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by EEF-CVE-2026-111497?
brotli (Hex): from 0.3.0 before 0.3.4.Source: cve.now feed data
How do I fix EEF-CVE-2026-111497?
Upgrade to a fixed version: 0.3.4.Source: cve.now feed data