tag: Memory-Corruption · 3 items
- Engineer — Plan: Brotli is bundled with Node.js and widely used for HTTP compression; the memory-corruption primitive is serious, but no KEV listing, public PoC, or EPSS signal is present. Audit Node.js versions across services and schedule patching to the fixed release this sprint.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC exists for this buffer-overflow RCE in the Brotli decoder, and the affected surface is wide: update Python brotli and brotlicffi packages to patched versions and audit any Envoy proxy configuration that enables Brotli decompression, since attacker-controlled compressed payloads are the trigger.
- SOC/IR — Learn: No active exploitation campaign, no published IOCs, and EPSS sits at effectively zero — there is no hunt or detection to run today, but analysts should understand that Brotli-decompressing endpoints (Envoy, Python services) represent an emerging RCE surface to watch if exploitation picks up.
- Leader — Skip
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A public PoC demonstrating client-side code execution exists; curl is present in virtually every container base image, CI/CD runner, and server. Patch to curl 8.23.0 now — check container base images, pipeline runners, and any service that uploads via HTTP/2.
- SOC/IR — Learn: No IOCs, no active exploitation reported, and the attack surface (malicious server exploiting an uploading client) offers limited detection opportunity; understanding the attack vector is useful for triage context if crashes or anomalous curl behavior surface later.
- Leader — Skip