Default AutomaticDecompression = All routes responses through the Brotli decoder affected by CVE-2026-111497
評価
- 難易度
- 2/5
- 見積もり時間
- 1〜3時間
- 初心者へのやさしさ
- 35/100
調査の方向性
Start in src/RestSharp/Options/RestClientOptions.cs and read the default for AutomaticDecompression, then check the proposed resolution in linked pull request #2419. Done means the .NET default uses GZip and Deflate without advertising or decoding Brotli, with the related documentation and changelog updated.
索引モデルが issue の本文から書いたものです。
説明
Describe the bug
RestClientOptions.AutomaticDecompression defaults to DecompressionMethods.All on .NET (src/RestSharp/Options/RestClientOptions.cs). Every RestClient built with default options therefore advertises Accept-Encoding: gzip, deflate, br and auto-decodes Content-Encoding: br responses through the Brotli decoder bundled in the .NET runtime.
That decoder is affected by CVE-2026-111497 (CVSS 4.0: 9.2): an out-of-bounds write in Google Brotli 1.0.3–1.2.0 triggered by a crafted stream, leading to memory disclosure, crash, or code execution in the decoding process. Public PoCs exist and code execution has been demonstrated against Node.js through the same "malicious server → auto-decompressed response" path.
HttpClientHandler/SocketsHttpHandler default to AutomaticDecompression = None, so plain HttpClient users are not exposed. RestSharp's default opts every user in without them ever mentioning Brotli. The bug is the runtime's, but as of 2026-10-24 no .NET servicing release contains the fix and no public dotnet/runtime branch has it (vendored Brotli is 1.1.0 on release/9.0–main, 1.0.9 on release/8.0; the upstream fix's BLOCK_SWITCH error code is absent on all of them), so users have no runtime update to apply.
To Reproduce
using var client = new RestClient("https://<your-request-bin>");
await client.ExecuteAsync(new RestRequest(""));
The captured request carries Accept-Encoding: gzip, deflate, br. Any server that answers with Content-Encoding: br has its body passed to the runtime's Brotli decoder before RestSharp hands it back. Same with new RestClient(new RestClientOptions(url)) — no decompression setting touched.
Expected behavior
A default RestClient should not advertise br or decode br responses while the runtime decoder is known-vulnerable and unpatched. With AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate the request carries Accept-Encoding: gzip, deflate and a br response is returned undecoded in RawBytes — the decoder is never reached. Servers that support Brotli also support gzip, so there is no functional loss.
Stack trace
None — the issue is reachability of vulnerable code, not an exception.
Desktop (please complete the following information):
- OS: macOS
- .NET version: .NET 10 (SDK 10.0.401); applies to all
#if NETtargets (net8.0/net9.0/net10.0). .NET Framework defaults toGZipand is not affected. - Version: 114.1.0 (NuGet latest) and
dev@ 466e5f8
Additional context
Only clients constructed from a URL, Uri or RestClientOptions are affected; a caller-supplied HttpClient/handler keeps the caller's setting. Exposure is proportional to how much control outsiders have over the URLs the client calls (third-party APIs, customer-supplied webhook endpoints, config-driven hosts).
Proposed resolution in #2419: change the .NET default to GZip | Deflate (Brotli opt-in) with docs and changelog, at least until patched runtimes ship.
References:
- Node.js advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- GHSA-9v8h-qqgm-4m35: https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- Upstream fix: https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
- Imperva analysis: https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
- 主要言語
- C#
- スター
- 9.8k
- フォーク
- 2.3k
- 平均マージ
- 11日 21時間
- マージ済み PR（30日）
- 2
環境構築
このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
restsharp/RestSharp のほかの issue
-
RestClientOptions.UserAgent missing from requests with useClientFactory: true対応中かも このイシューにリンクされたプルリクエストがオープン中、またはマージ済みです。 オープンbug
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
-
bug
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
-
feature-request rfc
難易度 5/5 1週間以上 初心者へのやさしさ 25/100
-
feature-request rfc
難易度 5/5 1週間以上 初心者へのやさしさ 38/100
-
awaiting-feedback feature-request
難易度 4/5 3〜5日 初心者へのやさしさ 45/100
restsharp/RestSharp の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 64/100
HicServices/RDMP#2398 ·
-
is:bug is:FQNIssue
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
nunit/nunit3-vs-adapter#1527 ·
メンテナーはふだん 1 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 72/100
メンテナーはふだん 1 日以内に返信
-
bug effort:S P3
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
nightscout/nocturne#2840 ·
メンテナーはふだん 1 日以内に返信
-
bug
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
fluentmigrator/fluentmigrator#2424 ·