Out-of-bounds write in the Brotli decoder in sbomify (CVE-2026-111497)

Summary

Out-of-bounds write in the Google Brotli decoder ("Node2Shell").

A buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0 lets a remote, unauthenticated attacker corrupt adjacent decoder memory with a crafted Brotli-compressed stream. This can disclose memory, cause a denial of service, or possibly lead to arbitrary code execution. The PyPI packages brotli (< 1.2.1) and brotlicffi (< 1.2.1.0) bundle the vulnerable decoder.

• Identifier: CVE-2026-111497 (aliases: GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323)
• Severity: critical (CNA vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
• CWE: CWE-787, CWE-252

Affected

• sbomify v26.2.0, v26.3.0, v26.7.0, v26.7.1, v26.8.0 and v26.9.0 ship pkg:pypi/[email protected] in the sbomify - Python Stack component. Releases before v26.2.0 do not include brotli.
• pkg:pypi/[email protected] is also locked, but only for non-CPython interpreters (fonttools[woff] marker platform_python_implementation != 'CPython'). The image runs CPython, so it is not installed.
• The hosted service at app.sbomify.com ran an affected build until the 2026-10-24 deploy of master.

Assessment

• brotli is a runtime dependency: weasyprint -> fonttools[woff] -> brotli (uv.lock at v26.9.0, line 263). The production image installs it with uv sync --locked --no-dev.
• With brotli importable, requests/urllib3 2.7.0 advertise br in Accept-Encoding and decode Content-Encoding: br responses on every outbound HTTP call. DependencyTrackClient (sbomify/apps/vulnerability_scanning/clients.py line 34 at v26.9.0) uses a requests.Session against a server URL the workspace configures, so a malicious or intercepted server can feed a crafted stream to the vulnerable decoder in the worker process.
• WeasyPrint also decodes WOFF2 fonts through the same library during PDF export. That input is not attacker-controlled, because markdown is HTML-escaped before rendering.

Remediation

• Fix: brotli 1.2.1 and brotlicffi 1.2.1.0 in https://github.com/sbomify/sbomify/pull/1899, merged into master as d50058a.
• Hosted service: app.sbomify.com runs master, which includes the fix, since the 2026-10-24 deploy. No action is needed.
• Released: sbomify v26.10.0 (https://github.com/sbomify/sbomify/releases/tag/v26.10.0) is the first tagged release with the fix. It locks brotli 1.2.1 and brotlicffi 1.2.1.0 (uv.lock lines 262-263 and 309-310 at v26.10.0).
• Self-hosted: upgrade to sbomify v26.10.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• https://github.com/advisories/GHSA-9v8h-qqgm-4m35
• https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml
• https://github.com/google/brotli/releases/tag/v1.2.1
• https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b