Documentation
¶
Overview ¶
Package brotli is the detector for CVE-2026-111497 (also called Node2Shell, Broccoli2Shell and HTTP2Shell): an out-of-bounds write in Google Brotli's C decoder, in every release from 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1 on October 21, 2026. It finds Brotli decoders in filesystems and container images, as shared libraries (libbrotlidec) and as copies bundled into Node.js, .NET, Python packages, Bun and other software, and judges each by what the binary itself proves (see internal/fingerprint), so vendor backports are recognised without any distribution data.
internal/fingerprint and internal/assess know nothing about the engine; this file only adapts them.
Index ¶
- Constants
- type Detector
- func (d *Detector) Fix(ctx context.Context, dirs []string, o engine.Options, stdout, stderr io.Writer) int
- func (d *Detector) Load() error
- func (d *Detector) Manifest() engine.Manifest
- func (d *Detector) NewScan(engine.TargetKind) engine.Scan
- func (d *Detector) ScanRepo(ctx context.Context, dir string, o engine.Options) *engine.Target
- func (d *Detector) Wants(_ string, head []byte, _ bool) bool
Constants ¶
const ( KindLibrary = string(assess.Library) KindBundled = string(assess.Bundled) KindGoPort = string(assess.GoPort) )
Kind IDs.
const ( KindNodePin = "node-pin" KindDotnetPin = "dotnet-pin" KindBunPin = "bun-pin" KindDependency = "dependency" KindNotChecked = "not-checked" )
Kind IDs for a source tree: what pins a vulnerable runtime or package.
const ID = "brotli"
ID is the detector's ID.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Detector ¶
type Detector struct{}
Detector implements engine.Detector, engine.Reader, engine.RepoScanner and engine.Fixer.
func (*Detector) Fix ¶
func (d *Detector) Fix(ctx context.Context, dirs []string, o engine.Options, stdout, stderr io.Writer) int
Fix moves a source tree's vulnerable pins to fixed releases: one verified edit each, an image only after the replacement is pulled and scanned clean on every platform the current one has. With opts.DryRun it prints the changes without writing them.
func (*Detector) NewScan ¶
func (d *Detector) NewScan(engine.TargetKind) engine.Scan
NewScan starts a filesystem or image scan.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
assess
Package assess judges one executable or shared library for CVE-2026-111497 from what internal/fingerprint reads in it, and names the fix for the software it belongs to.
|
Package assess judges one executable or shared library for CVE-2026-111497 from what internal/fingerprint reads in it, and names the fix for the software it belongs to. |
|
fingerprint
Package fingerprint reads what a binary proves about the Brotli decoder it carries, without running it.
|
Package fingerprint reads what a binary proves about the Brotli decoder it carries, without running it. |
|
pins
Package brotlipin finds the places a repository pins Node.js, .NET or Bun to a release whose bundled Brotli decoder lacks the fix for CVE-2026-111497 (Node2Shell, Broccoli2Shell: an out-of-bounds write in Brotli 1.0.3 through 1.2.0), and plans the deterministic one-line edit to the fixed release of the same line: Node.js 22.23.4, 24.22.1 and 26.12.1, .NET 8.0.33, 9.0.22 and 10.0.14, Bun 1.4.4.
|
Package brotlipin finds the places a repository pins Node.js, .NET or Bun to a release whose bundled Brotli decoder lacks the fix for CVE-2026-111497 (Node2Shell, Broccoli2Shell: an out-of-bounds write in Brotli 1.0.3 through 1.2.0), and plans the deterministic one-line edit to the fixed release of the same line: Node.js 22.23.4, 24.22.1 and 26.12.1, .NET 8.0.33, 9.0.22 and 10.0.14, Bun 1.4.4. |
|
testbin
Package testbin builds the small binaries the Brotli detector's tests read: decoder error tables exactly as each upstream release lays them out, and ELF, PE and Mach-O files that define or import decoder symbols.
|
Package testbin builds the small binaries the Brotli detector's tests read: decoder error tables exactly as each upstream release lays them out, and ELF, PE and Mach-O files that define or import decoder symbols. |