Detecting CVE-2026-111497 in Python Brotli: A Real LegacyFixer Security Scan

A Python project can have no visible application errors and still depend on a library with a known security issue. That is especially relevant for compression libraries: an application may process compressed content without exposing the decoder as an explicit part of its business logic.

On October 25, 2026, we ran LegacyFixer against a GitHub test repository intentionally pinned to Brotli==1.2.0. The objective was specific: determine whether the live detect-only scan would identify the newly disclosed Brotli vulnerability, preserve the reported remediation version, and complete without changing repository files or opening a pull request.

The vulnerability: CVE-2026-111497

CVE-2026-111497 concerns an out-of-bounds write in Google's Brotli decoder, in c/dec/decode.c. According to the PyPA advisory, a malformed compressed stream can trigger incorrect handling of an invalid block switch, allowing decoding to continue with corrupted state. Potential consequences include denial of service, memory disclosure, or code execution under relevant conditions.

The issue is not limited to Node.js. The Python package Brotli includes bindings for the same underlying decoder. For the PyPI package, the advisory identifies 1.2.1 as the fixed version; the upstream Brotli v1.2.1 release also identifies CVE-2026-111497 as a security fix.

The advisory's CVSS 4.0 score is 9.2 (Critical). This is the upstream severity assessment, not a severity calculated independently by the LegacyFixer report. Actual application exposure depends on whether untrusted Brotli-compressed input reaches the vulnerable decoder; the presence of a package alone does not establish exploitability.

The controlled GitHub test

We created the repository Dom-33/legacyfixer-brotli-cve-test with this explicit entry in requirements.txt:

Brotli==1.2.0

The repository was authorized for the LegacyFixer GitHub App and connected for scanning. Optional fix PRs remained disabled. We checked that the selected repository and its Run scan form both targeted its GitHub repository ID before initiating the scan.

This was a real scan through the deployed LegacyFixer application, not only a local pip-audit command or a mocked unit test.

What the production scan reported

On October 25, 2026, LegacyFixer completed scan #213 for Dom-33/legacyfixer-brotli-cve-test. The dashboard reported:

The dependency audit displayed the following entries:

These are two advisory entries for one underlying vulnerability, not evidence of two independent security flaws. Both records refer to CVE-2026-111497. The distinction matters when reviewing raw counts from vulnerability databases or scan reports: multiple advisory identifiers may describe the same issue.

Why NO_ACTION is not “no vulnerabilities”

The scan's result was success / NO_ACTION / passive_findings. In this case:

• success means the scan job completed;
• passive_findings means known dependency vulnerabilities were reported;
• NO_ACTION means the run did not perform a repository-changing remediation action.

The report explicitly stated that known vulnerabilities were reported and that detect-only mode did not change repository files or open a pull request. A successful scan and a clean dependency audit are therefore not interchangeable outcomes.

For this experiment, that separation was deliberate: the first goal was to verify the detection and the evidence, not to generate another dependency-update PR.

Checking the findings against upstream sources

We compared the two reported identifiers with their published records. The PyPA entry for PYSEC-2026-4322 names the Python brotli package, associates it with CVE-2026-111497, and identifies 1.2.1 as fixed. The GitHub advisory GHSA-9v8h-qqgm-4m35 also maps to that CVE. The Brotli v1.2.1 release notes identify the relevant security correction; the upstream fix commit documents the decoder change.

This independent comparison supports the package, advisory identity and fix-version evidence in scan #213. It does not mean that we executed a malicious compressed stream or demonstrated remote code execution.

Remediation and follow-up verification

For a Python project pinned to the vulnerable version in this test, the recommended next step is to evaluate an update to Brotli==1.2.1 or a later appropriate fixed release, followed by dependency auditing and application compatibility tests. For example, the pinned requirement could be changed to:

Brotli==1.2.1

That line illustrates a proposed remediation. We did not perform an upgrade or a post-upgrade scan as part of scan #213, so this guide does not claim a validated clean result after updating. Applications should also review where untrusted compressed data is decoded and whether system libraries, other bindings or vendored copies require separate attention.

What the experiment demonstrates—and what it does not

The live LegacyFixer scan demonstrates that, for this controlled GitHub repository, the production detect-only path identified the affected package version, reported two matching advisory references, preserved the auditor's fix version, and completed without a fix PR or repository changes.

It does not prove that all Brotli vulnerabilities would be detected, that the application was exploitable, that upgrading is automatically compatible with any particular codebase, or that a dependency-security report can replace application-level security testing.

The practical lesson is simple: identify and verify the dependency risk before deciding how the repository should change. A useful vulnerability report should provide more than an alert count; it should make the package, version, advisory identity, and available remediation evidence reviewable.

Sources and verification

• PyPA Advisory Database — PYSEC-2026-4322
• GitHub Advisory Database — GHSA-9v8h-qqgm-4m35
• Google Brotli — v1.2.1 release
• Google Brotli — upstream decoder fix commit
• CVE Record — CVE-2026-111497

Verification date: October 25, 2026. Advisory databases and available package releases can change. Recheck current data before making a production upgrade decision.