Broccoli2Shell: The One Decoder to Rule Them All
Blog post from Semgrep
CVE-2026-111497 is described as a heap out-of-bounds write in Google’s Brotli C decompressor, fixed upstream in Brotli 1.2.1, where malformed Brotli streams can cause invalid block-switch state to be handled as incomplete input and potentially lead to crashes, memory disclosure, or memory corruption. Although initially associated with Node2Shell, the issue affects the shared decoder as copied or bundled across numerous runtimes, libraries, databases, proxies, document and image tools, language bindings, and precompiled native packages, meaning updating a single dependency may not remediate every vulnerable instance. The text emphasizes that organizations must identify each embedded or statically linked Brotli copy and determine whether untrusted compressed data can reach it, since remediation may require a package upgrade, vendor release, runtime update, system-library patch, or rebuilding a larger artifact. It lists patched versions for major components including Brotli, Node.js, Bun, .NET, Envoy, Istio, Python bindings, and several language-specific implementations, while identifying many bundled packages that remain unfixed or have fixes awaiting release, particularly among archive tools, database systems, Python wheels, NuGet packages, and native addons.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.