Advisoriesby IbisAWSAWS-2026-155
Native Brotli Decoder Remote Code Execution and Memory Disclosure
No fix yet
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process memory in an affected application. AWS Lambda, AWS Amplify, AWS App Runner, Amazon CloudWatch Synthetics, AWS CodeBuild, AWS Elastic Beanstalk, and AWS Elemental MediaLive are addressing this issue. Some services require customer action. For details, see the bulletin. Read this article
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to Critical
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
Secret masking bypass in the environment tool in Strands Agents ToolsCVE-2026-115415no fix yetUnverified ownership of the default Athena query result location in AWS SDK for pandasCVE-2026-118029no fix yetSQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)CVE-2026-115418no fix yetDenial of service in the event stream header decoder in AWS SDK for Go v2CVE-2026-89090no fix yetXML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePluginCVE-2026-18061no fix yetServer-side request forgery in the Session Manager port forwarding functionality in AWS...CVE-2026-89049no fix yet