Out-of-bounds write in the Brotli decoder in the sbomify Action image (CVE-2026-111497)

Summary

Out-of-bounds write in the Google Brotli decoder ("Node2Shell") in the sbomify Action container image.

A buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0 lets a remote, unauthenticated attacker corrupt adjacent decoder memory with a crafted Brotli-compressed stream. This can disclose memory, cause a denial of service, or possibly lead to arbitrary code execution.

• Identifier: CVE-2026-111497 (alias GHSA-9v8h-qqgm-4m35)
• Severity: critical (CNA vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
• CWE: CWE-787

Affected

• sbomify Action container images 26.7.0, 26.8.0, 26.9.0, 26.10.0 and 26.10.1 (ghcr.io/sbomify/sbomify-action, mirrored as sbomifyhub/sbomify-action). They ship Debian trixie libbrotli1 1.1.0-2+b7.
• Debian fixed it in trixie-security as libbrotli1 1.1.0-2+deb13u1.

Assessment

• libbrotli1 is linked into git's HTTP transport: /usr/lib/git-core/git-remote-http → libcurl-gnutls.so.4 → libbrotlidec.so.1 (checked with ldd in every image listed above).
• git advertises Accept-Encoding: deflate, gzip, br, zstd, so a malicious or intercepted HTTPS git server can send a crafted Brotli stream to the vulnerable decoder.
• The action fetches over git when it resolves submodule version tags (git ls-remote against the .gitmodules URL) and when a generator clones a git dependency.
• This is separate from SBOMIFY-SA-2026-0004, which covered the PyPI brotli package in sbomify itself.

Remediation

• Fix: the sbomify Action v26.10.2 image (https://github.com/sbomify/sbomify-action/releases/tag/v26.10.2) ships libbrotli1 1.1.0-2+deb13u1. The image was rebuilt, and the Dockerfile's apt-get dist-upgrade picked up the Debian security update; no code change was needed.
• Verified: in ghcr.io/sbomify/sbomify-action@sha256:310e648728b006bfab71733bb11808b93f01be4fdc91c634e4e739f7c12eedea (tag 26.10.2, revision 57ca9ba, also latest), dpkg-query reports libbrotli1 1.1.0-2+deb13u1, and libbrotlidec.so.1 contains the BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH error code that upstream fix 0ed4268a adds.
• Users: upgrade to sbomify Action v26.10.2 or later. The GitHub Action runs ghcr.io/sbomify/sbomify-action:latest, which now points at 26.10.2. Pin 26.10.2 if your runner caches images.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• https://github.com/advisories/GHSA-9v8h-qqgm-4m35
• https://security-tracker.debian.org/tracker/CVE-2026-111497
• https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b