CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
CVE-2026-111497
Summary
Bulletin ID: 2026-156-AWS
Publication Date: 10/29/2026 09:30 AM PDT
Description:
We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use.
Impacted versions:
- aws-privateca-issuer before v1.10.1
- AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.