CLEANSTART-2026-PK34224: buffer overflow vulnerability in the Brotli decoder (c/dec/decode

Q: Does the advisory identify affected or fixed versions?

No affected versions, fixed versions, or patch details are provided in the available data. Version-level exposure cannot be determined from this advisory alone.

Q: Are exploit prerequisites or configuration conditions documented?

No attacker prerequisites, affected configurations, default-configuration status, or mitigations are specified in the available data.

Q: Is this issue tracked under a CVE?

Yes. It is referenced as CVE-2026-111497.

Published Nov 8, 2026

Updated

Security vulnerability affects the apache-nifi package. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.

Affected Software

1 affected componentFixes available

cleanstart/apache-nifi<2.12.0-r5

2.12.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.12.0-r5

Event History

Nov 8, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111497

Frequently Asked Questions

Does the advisory identify affected or fixed versions?

No affected versions, fixed versions, or patch details are provided in the available data. Version-level exposure cannot be determined from this advisory alone.

Are exploit prerequisites or configuration conditions documented?

No attacker prerequisites, affected configurations, default-configuration status, or mitigations are specified in the available data.

Is this issue tracked under a CVE?

Yes. It is referenced as CVE-2026-111497.

CLEANSTART-2026-PK34224: buffer overflow vulnerability in the Brotli decoder (c/dec/decode

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does the advisory identify affected or fixed versions?

Are exploit prerequisites or configuration conditions documented?

Is this issue tracked under a CVE?

Company

Resources

Contact

Frequently Asked Questions

Does the advisory identify affected or fixed versions?

Are exploit prerequisites or configuration conditions documented?

Is this issue tracked under a CVE?