title: Broccoli2Shell: Brotli decoders affected by CVE-2026-111497
agents: linux
catalog: os/misc
license: GPL-2.0-only
distribution: broccoli2shell
description:
 This check reports whether a Brotli decoder on the host is affected by
 the "Broccoli2Shell" out-of-bounds write CVE-2026-111497 in Google's C
 Brotli decoder, which can lead to remote code execution when untrusted
 Brotli data is decompressed (HTTP responses, request bodies, archives).

 It evaluates the {broccoli2shell} section of the agent plug-in shipped
 with this MKP (deploy it via the "Broccoli2Shell agent plug-in" bakery
 rule, or copy it to the host manually with a cache interval, e.g.
 {plugins/3600/}).

 A decoder counts as fixed if its version is at least the upstream fix of
 its branch, or if the changelog of the package that owns it names the CVE
 - the way Debian, Ubuntu, RHEL and their derivatives backport fixes
 without changing the upstream version:

 libbrotli and the Python package Brotli: 1.0.10, 1.1.1, 1.2.1 (versions
 before 1.0.3 are not affected). brotlicffi: 1.2.1.0. Node.js: 22.23.4,
 24.22.1, 26.12.1 (all other release lines are end of life). .NET: 8.0.33,
 9.0.22, 10.0.14.

 Node.js and Python extensions that are linked against the system library
 libbrotlidec (the Node.js packages of Debian, Ubuntu, RHEL, Fedora and
 Alpine, Debian's brotlicffi) do not use a decoder of their own: they take
 the result of that library, whatever their own version.

 A vulnerable decoder is {CRIT}, whether a running process has it loaded
 or not. Both states can be changed with the rule "Broccoli2Shell
 (CVE-2026-111497)".

item:
 The path of the decoder: the system library (directory and soname, e.g.
 {/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1}), the Node.js binary, the
 site-packages directory and package name of a Python installation (e.g.
 {/usr/lib/python3/dist-packages (brotli)}), or the .NET installation
 directory and runtime branch (e.g. {/usr/lib/dotnet (.NET 8.0)}).

discovery:
 One service is created for each decoder the agent plug-in finds.
