CVE-2026-111497 — Brotli remediation agent#

Deterministic audit, remediation and verification for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder: three shell scripts answer with a verdict, a remediation result and a verification result, and the model reads one line of each instead of exploring the host.

Read this in: English · Deutsch · 中文 · हिन्दी · Español · Русский

A deterministic detector, remediator and verifier for CVE-2026-111497 — an out-of-bounds
write in the Google Brotli decoder (c/dec/decode.c, CWE-787). Three shell scripts perform the
full audit and return a compact verdict; the language model orchestrates and reads one line
instead of exploring the host by hand.

Contents#

• Why this exists

• Exposure model

• Quick start

• Verdict and exit-code contract

• What the audit covers

• Repository layout

• Requirements

• Limitations

• Documentation

• Languages

• Contributing

• License

Wiki · Changelog · Security · Русская версия

Why this exists#

A complete Brotli audit is not a version check. It requires answering four questions per host:
which package is installed, whether the running processes still map the vulnerable decoder,
which application paths actually decode untrusted Brotli, and whether the distro backport is the
real fix rather than an unrelated rebuild.

Answered by hand, those questions cost dozens of tool calls per host and produce prose that
cannot be re-checked. Here they are answered by scripts with a fixed exit-code contract:

Exposure model#

The vulnerable code is the decoder, not the encoder. Services that only compress responses
with Brotli are not the attack surface; services that decompress untrusted Brotli are.

Vulnerable upstream releases are 1.0.3 through 1.2.0. Fixed releases are 1.0.10, 1.1.1 and
1.2.1 (shipped 21 October 2026), plus every distribution backport that references the CVE in
its packaged changelog.

Quick start#

# 1. Deliver the scripts once (host is an SSH alias from ~/.ssh/config)
scp src/common.sh src/detect.sh src/remediate.sh src/verify.sh <host>:/root/cve-2026-111497/

# 2. Audit — read-only
ssh <host> 'bash /root/cve-2026-111497/detect.sh'          # exit 0/1/3/10

# 3. Remediate — only when the verdict is VULNERABLE
ssh <host> 'bash /root/cve-2026-111497/remediate.sh'

# 4. Verify the actual effect
ssh <host> 'bash /root/cve-2026-111497/verify.sh'          # VERIFY: PASS|FAIL

Verdict and exit-code contract#

remediate.sh stops with code 10 before touching the system when the apt candidate equals the
installed version, or when the candidate changelog does not reference CVE-2026-111497.

What the audit covers#

Repository layout#

src/
  common.sh      logging, version parsing, classification matrix, state_get
  detect.sh      read-only audit: verdict, JSON report, before-state
  remediate.sh   backup, authenticity gate, dry-run, install, restart, inode check
  verify.sh      version, CVE reference, stale mappings, failed units, round-trip
docs/
  THREAT-MODEL.md  decode-path exposure model and attack surface
  PLAYBOOK.md      phase-by-phase procedure for a human auditor
  FIELD-REPORT.md  anonymised results from three production hosts
wiki/             operator documentation, field cases, advisory digest
SKILL.md          agent skill: the minimal orchestration playbook
AGENTS.md         repository rules and invariants

Requirements#

• Target host: Debian 12, Ubuntu 24.04 or Ubuntu 26.04 with apt, root over an SSH key.

• bash 5.x, dpkg, apt-get, systemd; curl and brotli are optional and only widen the
  functional round-trip.

• No network access from the tooling beyond the distribution package mirrors.

• Output state: /var/lib/cve-2026-111497/ (report.json, state.before, state.after).

• Backups: /root/cve-2026-111497-fix-<timestamp>/ with old .deb, current .so and a dpkg
  snapshot.

Limitations#

• apt only. rpm-based hosts, Alpine and container base images are out of scope; the
  classification matrix is portable but the remediation path is not.

• No static-linking detection. A Brotli copy compiled into a binary or a container image is
  not visible to dpkg. The detector reports runtime versions it can read and nothing more.

• No orchestration layer. Envoy, Istio, .NET, Bun and Deno are described in the threat model
  but are not remediated by the scripts.

• Desktop and infrastructure consumers are deferred, not restarted. Font and GUI stacks map
  libbrotlidec through freetype; restarting them would drop the session. They are reported as
  deferred and reload the patched library on the next login or reboot.

• needrestart may act first. On Ubuntu 24.04 the package hook restarts server services
  during installation, so the restart section may legitimately find nothing left to do.

• Field data is three hosts. The report is a sample, not a fleet census.

Documentation#

Languages#

English is canonical: a document without a language suffix is the source of truth. Every
translation carries the suffix of its language and links back to the canonical file.

The changelog and the wiki are English-only by policy: a release log and an operator handbook are
maintained as single sources, and a translation that lags behind is worse than none.

Contributing#

Fixes and new distro backports are welcome. Read CONTRIBUTING.md first: the
exit-code contract, the backup-before-change rule and the authenticity gate are not negotiable.
Security reports follow SECURITY.md.

License#

MIT. The tool is defensive; it contains no credentials, no infrastructure identifiers and no
target addresses.