Broccoli2Shell: the Brotli Bug Gets a Census, and OpenAI Codex Security Gets the Credit

The Brotli bug that spawned this week’s naming race got its definitive treatment on October 25: Broccoli2Shell, a site that maps CVE-2026-111497 across every ecosystem that touches Google’s C Brotli decoder, and the census is wider than the Node-and-Python scope of Friday’s HTTP2Shell coverage. Two facts stand out. First, the original bug report came from OpenAI Codex Security, making this the highest-profile product yet of OpenAI’s defensive-AI pipeline. Second, the affected list includes vendored private copies of the decoder that remain unpatched as of October 26, in the .NET runtime, DuckDB, Apache Arrow’s bundled builds, v8-jsi, 7-Zip-zstd, p7zip, EDK II, and woff2.

The mechanics, and why the rename is fair

The bug is an out-of-bounds write in DecodeBlockTypeAndLength() in the decoder’s C implementation: a crafted compressed stream contains an impossible block-switch that the decoder mishandles as “need more input,” overflowing an eight-byte internal buffer and corrupting state, which can end in crash, memory leak, or remote code execution. Juliano Rizzo, who renamed the vulnerability Broccoli (retiring “Node2Shell” as a terrible name), called it “a bigger deal than PHP2Shell,” and the census justifies the comparison: Google Brotli 1.0.3 through 1.2.0 is affected; Node.js bundles its own copy (fixed in 22.23.4, 24.22.1, 26.12.1, with lines 20, 23, and 25 end-of-life and unfixable); Python’s PyPI Brotli and brotlicffi packages expose urllib3, requests, aiohttp, httpx, and Scrapy even in applications that never import them; system libbrotli1 needs a distro patch plus a process restart; and JNI, PHP, Ruby, and Go-cgo bindings inherit the bug from the same C source. Exposure requires only that attacker-controlled Brotli data reaches the decoder, which includes every fetch() that auto-decodes a Content-Encoding: br response.

The memory-safety table, and the unfixed column

The most useful part of the site is a table most vendors would rather not appear in. Clean: the non-C decoders, Rust’s brotli-decompressor and the Java, JavaScript, and C# ports, which either lack the bug or could only crash. Fixed since disclosure: Ruby’s brotli gem 0.9.1, the PHP brotli extension 0.21.1, MuPDF 1.28.0, UEFITool, and merged-but-unreleased fixes in ClickHouse, GraalJS, NanaZip, YDB, and libjxl. Still unfixed as of October 26: the vendored copies listed above, including the .NET runtime and DuckDB. And the Go port (andybalholm/brotli) had the same logic error but could only crash, fixed October 23. This is the empirical version of the argument this week’s formal-verification research made theoretically: the same C code copied into a hundred projects becomes a hundred separate patch timelines, and the memory-safe reimplementation dodges the class entirely. Imperva’s red team achieved working code execution on stock Node.js 24.22.0 Linux arm64; no in-the-wild exploitation has been reported as of October 22.

The OpenAI Codex Security credit, and what to watch

The disclosure credit matters as much as the census. OpenAI Codex Security reported the bug, which places this find in the same pipeline as Project Daybreak’s PHP2Shell work and OpenAI’s Patch the Planet remediation effort, and it landed a fix credited to Matteo Collina and Antoine du Hamel in Node plus exploitation research from Imperva’s Ron Masas. An AI-assisted discovery process producing a cross-ecosystem CVE census site within a week of patch day is the defensive tempo the offensive side has been setting all month. What to watch: whether the unfixed vendored column shrinks this week (DuckDB and Arrow are the highest-profile), whether the $something2shell domain-squatting trend produces a standard disclosure format or just noise, and whether OpenAI Codex Security’s find rate, PHP-class bugs via Daybreak, this via Codex, becomes the benchmark AI security tooling is judged by. For operators, the checklist is unchanged and urgent: upgrade runtimes and packages, restart every process, rebuild container images, update lockfile pins, and remember that uninstalling Brotli or brotlicffi is a real mitigation on the Python side because clients fall back to gzip.