Security Advisory: CVE-2026-111497 – Google Brotli Decoder Out-of-Bounds Write (“Broccoli2Shell”)

Date Published: 2026-10-27
CVE Reference: CVE-2026-111497
Component: Google Brotli (C decoder) and libraries that bundle it
Affected versions: 1.0.3–1.0.9, 1.1.0, 1.2.0
Fixed versions: 1.0.10, 1.1.1, 1.2.1
Skyve status: Not affected

Summary

On 22 October 2026, a critical vulnerability was disclosed in the decoder of Google’s Brotli compression library. It is widely reported as “Broccoli2Shell”, “Node2Shell” or “HTTP2Shell”. An invalid block switch in a crafted Brotli stream is treated as a request for more input. Decoding then carries on in an invalid state and writes past the end of its buffer. A remote, unauthenticated attacker who can get a vulnerable decoder to process their data may be able to leak memory, crash the process, or run code. The issue is rated 9.2 (Critical) under CVSS 4.0, and exploit traffic has been reported in the wild.

The flaw reaches anything that embeds the native Brotli decoder: Node.js, .NET, Python packages, and Java libraries such as brotli4j, which is used by Netty-based stacks.

Skyve Impact

Skyve applications are not affected. We reviewed the Skyve platform, the libraries it ships with, the Java runtime and our standard WildFly container images.

Why Skyve Is Not Affected

  1. No Brotli decoder in Skyve. The Skyve framework does not depend on brotli4j or any other Brotli implementation. Libraries that can optionally decode Brotli, such as Apache Commons Compress and Netty, only do so when a Brotli library is also installed, and Skyve doesn’t install one.

  2. The Java runtime does not include Brotli. The JDK has no Brotli support, so Java applications are only exposed if they add a Brotli library themselves.

  3. WildFly does not decode Brotli requests. Undertow, the web server inside WildFly, supports gzip and deflate only. A request sent with Content-Encoding: br is never decompressed by the server.

A Note on Container Image Scans

The Red Hat Enterprise Linux base used by the official WildFly images (and so by the Skyve WildFly images) includes the operating system package libbrotli at a version in the affected range. Only the operating system’s font library uses it, and Skyve, WildFly and the Java runtime never call it. Vulnerability scanners may still report it. We will publish updated Skyve WildFly images once Red Hat releases a patched package. Picking up the fix will only require rebuilding your container, with no change to Skyve or your application.

Recommended Actions

  • Skyve applications: No action is required.

  • Custom dependencies: If your application adds its own libraries, check that none of them bring in com.aayushatharva.brotli4j (run mvn dependency:tree). If one does, upgrade brotli4j to 1.24.0 or later.

  • Container images: Rebuild on the updated Skyve WildFly images when they are released so that scanners stop reporting libbrotli.

  • Other services in your environment: Reverse proxies, Node.js or .NET services, and other tools that decode Brotli may be affected. Check with those vendors for patches.

Need Help?

If you have questions about this advisory or your deployment, please reach out through the Skyve GitHub discussions, Slack, or your usual Biz Hub support channel.

Ben PetitoComment