[C++] Bundled Brotli 1.0.9 is affected by CVE-2026-111497 (decoder out-of-bounds write)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
Start by checking the Brotli pin in cpp/thirdparty/versions.txt and the bundled decoder headers against upstream fix commit 0ed4268a4401abcb4472096340477cf4af7d1a2b. Update the bundled version to v1.2.1 or apply the fix, then run the relevant Brotli and Parquet or IPC tests. Done means the bundled decoder contains the fix, including the stated error definition, and affected compressed files are handled safely.
Written by the indexing model from the issue text.
Description
CVE-2026-111497 is an out-of-bounds write in the Brotli C decoder (c/dec/decode.c, versions 1.0.3 through 1.2.0). A crafted stream can request an impossible block switch, which the decoder mistakes for "needs more input". It then writes past the end of an internal 8-byte buffer. GitHub rates it 9.2 (CVSS 4.0), and Node.js shipped fixes for it on 2026-10-21.
cpp/thirdparty/versions.txt pins ARROW_BROTLI_BUILD_VERSION=v1.0.9, and that version is used whenever Brotli is built as a bundled dependency. In those builds, reading a Parquet or IPC file that contains Brotli-compressed data passes the file's contents to the decoder, so a crafted file can trigger the bug. Builds that link a patched system Brotli aren't affected.
Upstream fixed this in Brotli 1.0.10, 1.1.1 and 1.2.1 (fix commit). Updating the bundled copy to v1.2.1, or applying that commit, resolves it. A patched copy is easy to recognise: its decode.h defines BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17).
References:
- Advisory: https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- Upstream release: https://github.com/google/brotli/releases/tag/v1.2.1
- Overview of affected software and bundled copies: https://broccoli2shell.com/
- Dominant language
- C++
- Stars
- 17.2k
- Forks
- 4.4k
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 66
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/arrow
-
Component: Continuous Integration Component: Documentation
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
apache/arrow#54696 · 2 comments ·
Maintainers usually reply within 1 day
-
[R][Parquet] ParquetReaderProperties does not expose page_checksum_verification, so a corrupt page CRC reads silentlyMay be free again A pull request for this issue was closed without being merged. OpenComponent: R good-first-issue Type: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
apache/arrow#53138 · 2 comments ·
Maintainers usually reply within 1 day
-
[C++][Python] IPC reader rejects a DictionaryEncoding without indexType, which the format allowsPossibly taken A pull request linked to this issue is open or already merged. OpenComponent: C++ Component: Python Type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
[R] Silent loss of metadata integrity for date-time and numeric attributes in write_parquet()/read_parquet()May be free again @james-finn-travers claimed this 24 days ago, and no pull request is open. OpenComponent: R Type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
apache/arrow#51695 · 1 comment ·
Maintainers usually reply within 1 day
-
[C++][Parquet] Plaintext-footer files written with AES_GCM_CTR_V1 record AES_GCM_V1 as the encryption algorithm and cannot be readPossibly taken @autoCAT6 claimed this 6 days ago. OpenType: bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
Similar issues
-
bug intrinsic medium priority rt_lib
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
sumatrapdfreader/sumatrapdf#6417 · 3 comments ·
-
[BUG] Cython cache evicts most recent instead of oldest entry on cleanupPossibly taken @scoder claimed this today. OpenBuild System defect
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
NVIDIA-Omniverse/PhysX#590 · 1 comment ·
Maintainers usually reply within 1 day