title: Broccoli2Shell: processes still using a replaced Brotli decoder
agents: linux
catalog: os/misc
license: GPL-2.0-only
distribution: broccoli2shell
description:
 This check counts processes that still have a Brotli decoder mapped that
 has been deleted on disk - libbrotlidec, a node binary, a Python Brotli
 extension module or the .NET compression library. Typically the package
 was updated, but the service using it was not restarted. These processes
 still run the old, possibly vulnerable code, so a fixed version on disk
 alone does not protect against CVE-2026-111497.

 The service is {CRIT} if there is at least one such process, configurable
 with the rule "Broccoli2Shell restart". Processes inside containers are
 not considered.

 It evaluates the {broccoli2shell} section of the agent plug-in shipped
 with this MKP. Since the plug-in runs cached, the service turns {OK} at
 the latest one cache interval after the restart.

discovery:
 One service is created on every host on which the agent plug-in finds a
 Brotli decoder.
