Low Severity
CVE-2026-111497
Published: Oct 29, 2026
Finds copies of the Google Brotli decoder affected by CVE-2026-111497 on Ubuntu and Debian hosts: the OS packages, and the bundled copies an OS update does not fix (Node.js, Python, Envoy, browsers and more). Built by trial and error with AI-Ops, starting with the OSes on my own machines and servers. A PowerShell version for Windows is planned.
# brotli-cve-check
A shell script that finds, on one Ubuntu or Debian host, the copies of the Google Brotli
**decoder** that may be affected by **CVE-2026-111497** (out-of-bounds write in
`c/dec/decode.c`), and lists, on the evidence of versions and strings, the ones that need an
update or a check.
Affected are Brotli 1.0.3 to 1.0.9, 1.1.0 and 1.2.0 (the advisory's range 1.0.3 to 1.2.0,
minus the fixed releases 1.0.10 and 1.1.1). The fixed releases are 1.0.10, 1.1.1 and 1.2.1.
Debian and Ubuntu take in fixes without changing the version number, so distribution packages
are judged against the distributor's fixed versions.
Keywords: CVE-2026-111497, GHSA-9v8h-qqgm-4m35, Brotli decoder, "HTTP2Shell", "Node2Shell".
(Despite the nickname, this is not an HTTP/2 flaw.)
What the flaw is, which paths can carry attacker data to a decoder, and how to judge whether it
concerns you: [technical note by J-MEDIC Co., Ltd. (in Japanese)](https://www.jmedic.co.jp/pubdoc/http2shell_report_20261027.html). This tool is the
next step: it inventories one host.
日本語: [README.ja.md](README.ja.md) / 医療機関・中小企業の方へ: [docs/for-clinics.ja.md](docs/for-clinics.ja.md)
(Every document in docs/ has a Japanese version next to it as `*.ja.md`.)
## What it tells you, and what it does not
**It tells you**
- where on the host copies of the Brotli decoder are, and whether each is a fixed version. Not
only distribution packages (`libbrotli1`, `python3-brotli`, ...) but also the bundled copies
that updating the OS does **not** fix (Node.js, Bun, PyPI `Brotli` / `brotlicffi`, conda,
Envoy, browsers, snap/flatpak apps, `libbrotlidec` files outside the package manager, ...);
- which processes keep using deleted old files after an update;
- what it could not judge, and why; and what it did not look at (always listed as "Not scanned").
**It does not tell you (and does not judge)**
- whether attacker-controlled data can reach a decoder it found. Data can come in as a
compressed request, as a respo