---
name: cve-2026-111497-brotli
description: Deterministic audit and remediation of CVE-2026-111497 (out-of-bounds write in the Google Brotli decoder, CVSS 4.0 9.2) on apt-based Linux hosts. Three scripts — detect.sh, remediate.sh, verify.sh — replace manual host exploration and keep the language model's token spend minimal. Load when auditing or remediating this CVE on any Debian or Ubuntu host.
whenToUse: When a Debian or Ubuntu server must be checked for or remediated against CVE-2026-111497 (Brotli): vulnerability verdict, decode-path discovery, distribution backport, consumer restart, verification of the achieved effect.
metadata:
  severity: critical
  cve: CVE-2026-111497
  cwe: CWE-787
  platform: Debian 12, Ubuntu 24.04, Ubuntu 26.04
---

# Remediation agent for CVE-2026-111497 (Brotli)

## Purpose

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder. Exploitation needs no
authentication: a crafted Brotli stream crashes the process, corrupts memory and, in some
configurations, achieves remote code execution.

This agent reduces a full audit and remediation to **three deterministic steps**, each returning
a compact machine-readable verdict. The model orchestrates the run and reads one or two lines; it
does not explore the host by hand.

## Operating procedure (minimal token spend)

Preparation — deliver the scripts to the target host once:

```bash
scp src/common.sh src/detect.sh src/remediate.sh src/verify.sh <host>:/root/cve-2026-111497/
```

### Step 1 — Audit (read-only)

```bash
ssh <host> 'bash /root/cve-2026-111497/detect.sh'
```

Read only the last line: the verdict and a compact summary (about seven lines). A JSON report is
written to `/var/lib/cve-2026-111497/report.json`.

| Exit code | Verdict | Action |
|---|---|---|
| 0 | SAFE | do nothing, document the result |
| 1 | VULNERABLE | continue to step 2 |
| 3 | NOT_INSTALLED | `libbrotli1` absent — document |
| 10 | ERROR | read the message, escalate |

### Step 2 — Remediation (only on VULNERABLE)

```bash
ssh <host> 'bash /root/cve-2026-111497/remediate.sh'
```

The script performs the following, in this order, without model involvement:

1. Backup of the old `.deb`, the current `.so` files and a `dpkg` snapshot into
   `/root/cve-2026-111497-fix-<timestamp>/`.
2. **Authenticity gate** — the candidate package is downloaded and its changelog must reference
   `CVE-2026-111497`. Without that reference the install does not happen.
3. Dry run of `apt-get install --only-upgrade`.
4. Installation of the backport (`libbrotli1`, plus `libbrotli-dev` when installed).
5. Restart of **server** consumers of the decoder, resolved from `/proc/*/maps` and cgroup;
   desktop and infrastructure processes (GNOME, NetworkManager, VPN, fwupd) are deliberately
   deferred — they reload the library on the next login or reboot.
6. Check that no process keeps an old inode mapped.

### Step 3 — Verification of the achieved effect

```bash
ssh <host> 'bash /root/cve-2026-111497/verify.sh'
```

Read the last line: `VERIFY: PASS` (exit 0) or `VERIFY: FAIL` (exit 1).

## Audit surface

- `libbrotli1` version, classified against the vulnerable release matrix (1.0.3–1.0.9, 1.1.0,
  1.2.0) with distribution backports taken into account.
- Live consumers of the decoder (`libbrotlidec`) via `/proc/*/maps`.
- Decode paths: libcurl (`brotli/...`), Node.js, Python `Brotli`/`brotlicffi`, the PHP brotli
  extension, `ngx_brotli`, `mod_brotli`.
- Count of PHP files using `CURLOPT_ENCODING` / `CURLOPT_ACCEPT_ENCODING` — automatic
  `Content-Encoding: br` decoding in WordPress Requests, SimplePie and Guzzle.

## Scope limits

- Covers distributions with apt (Debian, Ubuntu) and an official backport in `-security`. Without
  a backport the script stops and requires manual mitigation (blocking `Content-Encoding: br` at
  the edge) or building brotli 1.2.1 or newer from source.
- Does not touch Envoy, Istio, .NET, Bun or Deno — they are outside the perimeter of the hosts
  this agent was built for.

## Safety rules (mandatory)

- Root is required on the target host.
- No change before the candidate authenticity gate passes.
- Rollback: `dpkg -i <backup>/deb/libbrotli1_*.deb`, then restart the services listed in step 2.
- After remediation check `systemctl --failed` and the availability of the hosted sites.