CVE-2026-111497 is an out-of-bounds write in the brotli decoder when a
stream contains an invalid block switch. It was fixed upstream in
google/brotli commit 0ed4268a (v1.2.1). The Go port has the same bug and
fixes it in github.com/andybalholm/brotli v1.2.7 (commit 33c2a988,
"Detect and report invalid stream earlier"). In Go the likely impact is a
panic while decoding a crafted brotli stream.
Claude-Session: https://claude.ai/code/session_01NurERth3rFKgFjZ8xzyUMH
Co-authored-by: Claude Opus 5.5 [email protected]