Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Default AutomaticDecompression = All routes responses through the Brotli decoder affected by CVE-2026-111497

Aperta
  • Qualcosa non va?
#2,420 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@K3UL ci sta già lavorando.

Dal 24/10/2026.

  • #2419 di @K3UL — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
csharp
Ambito
backend, security

Direzione di ricerca

Start in src/RestSharp/Options/RestClientOptions.cs and read the default for AutomaticDecompression, then check the proposed resolution in linked pull request #2419. Done means the .NET default uses GZip and Deflate without advertising or decoding Brotli, with the related documentation and changelog updated.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

Describe the bug
RestClientOptions.AutomaticDecompression defaults to DecompressionMethods.All on .NET (src/RestSharp/Options/RestClientOptions.cs). Every RestClient built with default options therefore advertises Accept-Encoding: gzip, deflate, br and auto-decodes Content-Encoding: br responses through the Brotli decoder bundled in the .NET runtime.

That decoder is affected by CVE-2026-111497 (CVSS 4.0: 9.2): an out-of-bounds write in Google Brotli 1.0.3–1.2.0 triggered by a crafted stream, leading to memory disclosure, crash, or code execution in the decoding process. Public PoCs exist and code execution has been demonstrated against Node.js through the same "malicious server → auto-decompressed response" path.

HttpClientHandler/SocketsHttpHandler default to AutomaticDecompression = None, so plain HttpClient users are not exposed. RestSharp's default opts every user in without them ever mentioning Brotli. The bug is the runtime's, but as of 2026-10-24 no .NET servicing release contains the fix and no public dotnet/runtime branch has it (vendored Brotli is 1.1.0 on release/9.0–main, 1.0.9 on release/8.0; the upstream fix's BLOCK_SWITCH error code is absent on all of them), so users have no runtime update to apply.

To Reproduce

using var client = new RestClient("https://<your-request-bin>");
await client.ExecuteAsync(new RestRequest(""));

The captured request carries Accept-Encoding: gzip, deflate, br. Any server that answers with Content-Encoding: br has its body passed to the runtime's Brotli decoder before RestSharp hands it back. Same with new RestClient(new RestClientOptions(url)) — no decompression setting touched.

Expected behavior
A default RestClient should not advertise br or decode br responses while the runtime decoder is known-vulnerable and unpatched. With AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate the request carries Accept-Encoding: gzip, deflate and a br response is returned undecoded in RawBytes — the decoder is never reached. Servers that support Brotli also support gzip, so there is no functional loss.

Stack trace
None — the issue is reachability of vulnerable code, not an exception.

Desktop (please complete the following information):

  • OS: macOS
  • .NET version: .NET 10 (SDK 10.0.401); applies to all #if NET targets (net8.0/net9.0/net10.0). .NET Framework defaults to GZip and is not affected.
  • Version: 114.1.0 (NuGet latest) and dev @ 466e5f8

Additional context
Only clients constructed from a URL, Uri or RestClientOptions are affected; a caller-supplied HttpClient/handler keeps the caller's setting. Exposure is proportional to how much control outsiders have over the URLs the client calls (third-party APIs, customer-supplied webhook endpoints, config-driven hosts).

Proposed resolution in #2419: change the .NET default to GZip | Deflate (Brotli opt-in) with docs and changelog, at least until patched runtimes ship.

References:

Lingua principale
C#
Stelle
9.8k
Fork
2.3k
Merge medio
11g 21h
PR unite (30g)
2

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di restsharp/RestSharp

Tutte le issue di restsharp/RestSharp

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.