CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process memory in an affected application. AWS Lambda, AWS Amplify, AWS App Runner, Amazon CloudWatch Synthetics, AWS CodeBuild, AWS Elastic Beanstalk, and AWS Elemental MediaLive are addressing this issue. Some services require customer action. For details, see the bulletin. Read this article
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services
- Product
- AWS services
- EPSS
- 0.83 (p100)
- Exposure class
- Cloud platform
Why it ranks 48 (High)
- EPSS 0.88 (high probability of exploitation)
- Product class: cloud platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 19 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.