{"id":"EEF-CVE-2026-111497","summary":"Out-of-bounds write in the Brotli decoder bundled with erl-brotli","details":"## Summary\n\nOut-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to `brotli:decode/1` to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.\n\nerl-brotli compiles its own copy of the Google Brotli C sources under `c_src` into a NIF, and `brotli_decoder_decompress_stream` in `c_src/brotli_nif.c` hands the input to `BrotliDecoderDecompressStream`. In `c_src/dec/decode.c`, `DecodeBlockTypeAndLength` returns false for a block switch in a category with at most one block type, and the non-streaming callers `DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch` and `DecodeDistanceBlockSwitch` discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.\n\nThis issue affects brotli: from 0.3.0 before 0.3.4.\n\n## Impact\n\nAn attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses `Content-Encoding: br` responses with this package, can crash the Erlang VM and potentially run code inside it.","modified":"2026-11-05T20:15:03.900045734Z","published":"2026-10-22T13:35:41.975Z","upstream":["CVE-2026-111497"],"database_specific":{"capec_ids":["CAPEC-100"],"cpe_ids":["cpe:2.3:a:yjh0502:erl-brotli:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-787"]},"references":[{"type":"WEB","url":"https://github.com/yjh0502/erl-brotli/issues/23"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-111497.html"},{"type":"WEB","url":"https://github.com/yjh0502/erl-brotli/releases/tag/v0.3.4"},{"type":"WEB","url":"https://github.com/yjh0502/erl-brotli/commit/1e2af9bebba40ee292abf51e19ac831c2658ca47"},{"type":"FIX","url":"https://github.com/yjh0502/erl-brotli/commit/7498e1c743c71a99636e8f897b6b016433830d6d"},{"type":"PACKAGE","url":"https://hex.pm/packages/brotli"}],"affected":[{"package":{"name":"brotli","ecosystem":"Hex","purl":"pkg:hex/brotli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.4"}]}],"versions":["0.3.0","0.3.1","0.3.2","0.3.3"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-111497.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/yjh0502/erl-brotli","events":[{"introduced":"1e2af9bebba40ee292abf51e19ac831c2658ca47"},{"fixed":"7498e1c743c71a99636e8f897b6b016433830d6d"}]}],"versions":["v0.3.2","v0.3.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-111497.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"liamwhite","type":"REPORTER"},{"name":"Łukasz Jan Niemier","type":"REMEDIATION_DEVELOPER"},{"name":"Łukasz Jan Niemier","type":"REPORTER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}