Broccoli2Shell: The One Decoder We All Depend On
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CVE-2026-111497 is a heap out-of-bounds write in Google's Brotli C decoder, present from 1.0.3 through 1.2.0 and fixed in 1.2.1, where an invalid block switch now returns an error. Semgrep's list shows the decoder is bundled in Node.js, Bun, .NET, Envoy, Python wheels, and database and document tools, so updating one package leaves other copies. Several, including DuckDB, Apache Arrow and Pillow, have no release yet. Builders need to inventory vendored copies, since some claims in the post, such as DuckDB's status, could not be independently verified.