Node2Shell in Python: the Brotli bug (CVE-2026-111497) in requests, aiohttp, pyarrow and Pillow

$ pip-audit -r requirements.txt --no-deps --disable-pip
Name       Version ID                  Fix Versions
---------- ------- ------------------- ------------
brotli     1.2.0   PYSEC-2026-4322     1.2.1
brotli     1.2.0   GHSA-9v8h-qqgm-4m35 1.2.1
brotlicffi 1.2.0.2 PYSEC-2026-4323     1.2.1.0
# pyarrow==26.0.0 and pillow==13.0.0 were in the same file: not flagged

brotli installed: True  brotlicffi installed: True
no              urllib.request (stdlib)      sent Accept-Encoding: identity
DECODES BROTLI  requests                     sent Accept-Encoding: gzip, deflate, br
DECODES BROTLI  httpx                        sent Accept-Encoding: gzip, deflate, br
DECODES BROTLI  aiohttp client               sent Accept-Encoding: gzip, deflate, br
DECODES BROTLI  aiohttp web request.json()   HTTP 200 {"got": "brotli"}
no              Flask request.get_json()     HTTP 200 {"error":"not JSON"}
no              FastAPI request.json()       HTTP 200 {"error":"not JSON"}

brotli installed: False  brotlicffi installed: False
no              requests                     sent Accept-Encoding: gzip, deflate
no              httpx                        sent Accept-Encoding: gzip, deflate
no              aiohttp web request.json()   HTTP 400 Can not decode content-encoding: brotli

#!/usr/bin/env python3
"""brotli_check.py: find copies of the Brotli C decoder hit by CVE-2026-111497.

Checks the Brotli and brotlicffi packages, then scans every compiled file in
this Python's site-packages (plus any folders you pass) for a bundled copy of
the Brotli C decoder, and reports which copies have the October 2026 fix.

  python brotli_check.py                       # this environment
  python brotli_check.py /usr/lib /opt/myapp   # also scan these folders

Exit code: 0 = no vulnerable copy found, 1 = at least one needs updating.
Standard library only; Python 3.8+.
"""
import importlib.metadata as md
import mmap
import os
import re
import site
import sys

# The fix added a new decoder error code. Its name only exists in fixed builds
# (including distribution backports that keep the old version number), while
# the older error names exist in every build since 1.0. Brotli 1.0.x stores
# them as "PADDING_1", 1.1 and later as "_ERROR_FORMAT_PADDING_1". Matched in
# the exact form the C library stores them, so Rust and Go ports are not counted.
OLD_NAME = re.compile(rb"(?<![A-Za-z0-9_])(?:_ERROR_FORMAT_)?PADDING_1\x00")
FIX_NAME = re.compile(rb"(?<![A-Za-z0-9_])(?:_ERROR_FORMAT_)?BLOCK_SWITCH\x00")
BINARY = re.compile(r"\.(so(\.\d+)*|pyd|dll|dylib)$", re.IGNORECASE)

FIXED_IN = {"brotli": (1, 2, 1), "brotlicffi": (1, 2, 1, 0)}

# What each installed package does with Brotli, from tests on 24 October 2026.
DECODES = {
    "urllib3": "requests and urllib3 offer br and decode Brotli responses when brotli or brotlicffi is installed.",
    "httpx": "httpx offers br and decodes Brotli responses when brotli or brotlicffi is installed.",
    "aiohttp": "aiohttp decodes Brotli responses, and its web server decodes Brotli request bodies from any client.",
    "scrapy": "Scrapy offers br on every request and decodes Brotli responses from the sites it crawls.",
    "fonttools": "fontTools decodes WOFF2 fonts with the brotli package.",
    "pyarrow": "pyarrow decodes Brotli-compressed Parquet and Arrow IPC data with its own bundled copy.",
    "pillow": "Pillow's bundled FreeType decodes WOFF2 fonts with a bundled libbrotlidec (Linux and macOS wheels).",
}
BUNDLED = {"pyarrow", "pillow"}  # decode with their own copy, not the brotli package


def parse_version(text):
    return tuple(int(p) for p in re.findall(r"\d+", text)[:4])


def package_status(name, version):
    """VULNERABLE, FIXED or n/a for a Brotli binding at this version."""
    v = parse_version(version)
    if v < (1, 0, 3):
        return "n/a (older than the affected range)"
    return "FIXED" if v >= FIXED_IN[name] else "VULNERABLE"


def classify_file(path):
    """Returns 'fixed', 'vulnerable' or None when the file holds no readable copy
    of the Brotli C decoder. Builds that strip the error names (some Windows
    DLLs) are not detected: check those by their package version."""
    try:
        size = os.path.getsize(path)
        if size == 0:
            return None
        with open(path, "rb") as fh, mmap.mmap(fh.fileno(), 0, access=mmap.ACCESS_READ) as data:
            if not OLD_NAME.search(data):
                return None
            return "fixed" if FIX_NAME.search(data) else "vulnerable"
    except (OSError, ValueError):
        return None


def owners():
    """Maps absolute file paths to the installed distribution that owns them."""
    result = {}
    for dist in md.distributions():
        name = dist.metadata["Name"]
        for f in dist.files or []:
            if BINARY.search(str(f)):
                result[os.path.normcase(os.path.realpath(dist.locate_file(f)))] = f"{name} {dist.version}"
    return result


def scan(folders):
    """Yields (path, status) for every binary under the folders that bundles the decoder."""
    seen = set()
    for folder in folders:
        for root, _dirs, files in os.walk(folder):
            for name in files:
                if not BINARY.search(name):
                    continue
                path = os.path.normcase(os.path.realpath(os.path.join(root, name)))
                if path in seen:
                    continue
                seen.add(path)
                status = classify_file(path)
                if status:
                    yield path, status


def main(argv):
    print("Brotli CVE-2026-111497 check")
    print(f"python: {sys.version.split()[0]} ({sys.executable})")
    problems = 0

    print("\nBrotli packages:")
    installed = {d.metadata["Name"].lower(): d.version for d in md.distributions()}
    for name in FIXED_IN:
        if name in installed:
            status = package_status(name, installed[name])
            problems += status == "VULNERABLE"
            want = ".".join(map(str, FIXED_IN[name]))
            print(f"  {status:10} {name} {installed[name]}" + ("" if status != "VULNERABLE" else f"  (update to {want} or later)"))
        else:
            print(f"  -          {name} not installed")

    folders = [p for p in dict.fromkeys(site.getsitepackages() + [site.getusersitepackages()]) if os.path.isdir(p)]
    folders += [p for p in argv if os.path.isdir(p)]
    who = owners()
    print("\nCompiled files that bundle the Brotli C decoder:")
    found = False
    for path, status in scan(folders):
        found = True
        problems += status == "vulnerable"
        label = "FIXED" if status == "fixed" else "VULNERABLE"
        print(f"  {label:10} {path}  [{who.get(path, 'outside Python packages')}]")
    if not found:
        print("  none found")

    # These only decode Brotli through the brotli or brotlicffi package.
    binding = any(name in installed for name in FIXED_IN)
    present = [k for k in DECODES if k in installed and (binding or k in BUNDLED)]
    if present:
        print("\nWhere this environment decodes Brotli from outside:")
        for k in present:
            print(f"  - {DECODES[k]}")

    if problems:
        print("\nACTION NEEDED: update the packages marked VULNERABLE, then restart the app.")
        print("Where no fixed release exists yet, keep untrusted Brotli data away from that package.")
    else:
        print("\nOK: no vulnerable copy of the Brotli C decoder found.")
    return 1 if problems else 0


if __name__ == "__main__":
    sys.exit(main(sys.argv[1:]))

python brotli_check.py                  # the environment this python runs
python brotli_check.py /usr/lib          # also scan a folder (system libraries, an app)
echo "exit code: $?"                     # 0 = nothing vulnerable, 1 = action needed

Brotli CVE-2026-111497 check
python: 3.11.3 (.venv\Scripts\python.exe)

Brotli packages:
  FIXED      brotli 1.2.1
  FIXED      brotlicffi 1.2.1.0

Compiled files that bundle the Brotli C decoder:
  FIXED      .venv\lib\site-packages\brotlicffi\_brotlicffi.pyd  [brotlicffi 1.2.1.0]
  VULNERABLE .venv\lib\site-packages\pyarrow\arrow.dll  [pyarrow 26.0.0]

Where this environment decodes Brotli from outside:
  - requests and urllib3 offer br and decode Brotli responses when brotli or brotlicffi is installed.
  - aiohttp decodes Brotli responses, and its web server decodes Brotli request bodies from any client.
  - pyarrow decodes Brotli-compressed Parquet and Arrow IPC data with its own bundled copy.

ACTION NEEDED: update the packages marked VULNERABLE, then restart the app.
Where no fixed release exists yet, keep untrusted Brotli data away from that package.

Compiled files that bundle the Brotli C decoder:
  VULNERABLE /usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.0.9  [outside Python packages]

VULNERABLE  libbrotli1 1.0.9-2+b6        (bookworm, before the fix)
FIXED       libbrotli1 1.0.9-2+deb12u1    (bookworm security update)
VULNERABLE  libbrotli1 1.1.0-2+b7        (trixie, before the fix)
FIXED       libbrotli1 1.1.0-2+deb13u1    (trixie security update)

# pip
pip install -U "brotli>=1.2.1" "brotlicffi>=1.2.1.0"

# uv
uv lock --upgrade-package brotli --upgrade-package brotlicffi && uv sync

# Poetry
poetry update brotli brotlicffi

# Then confirm what is actually installed
pip show brotli brotlicffi | grep -E "^(Name|Version)"

# constraints.txt: brotli usually arrives through urllib3[brotli],
# aiohttp[speedups], httpx[brotli] or Scrapy, so pin it here
brotli>=1.2.1
brotlicffi>=1.2.1.0

# pip install -r requirements.txt -c constraints.txt

# Debian (bookworm, trixie): fixes libbrotli1 and python3-brotli
sudo apt-get update && sudo apt-get install --only-upgrade libbrotli1 python3-brotli

# Alpine 3.21 and later
apk upgrade brotli-libs

from aiohttp import web

# Before: decodes Brotli (and gzip, deflate) request bodies automatically
app = web.Application()

# Stop-gap: request bodies reach your handler still compressed
app = web.Application(handler_args={"auto_decompress": False})

default                    valid brotli    decoder calls: 1  HTTP 200 {"got": "brotli"}
default                    invalid brotli  decoder calls: 1  HTTP 400 {"error": "RequestPayloadError"}
middleware rejecting br    valid brotli    decoder calls: 1  HTTP 415 {"error": "Brotli request bodies are not accepte
middleware rejecting br    invalid brotli  decoder calls: 1  HTTP 415 {"error": "Brotli request bodies are not accepte
auto_decompress=False      valid brotli    decoder calls: 0  HTTP 400 {"error": "UnicodeDecodeError"}
auto_decompress=False      invalid brotli  decoder calls: 0  HTTP 400 {"error": "UnicodeDecodeError"}

"""parquet_codecs.py: list the compression codecs in a Parquet file without decompressing it.

Reading the footer metadata does not touch compressed pages, so this is safe to
run on an untrusted file before deciding whether to read it.
  python parquet_codecs.py file.parquet   # exit 1 if any column uses BROTLI
"""
import sys

import pyarrow.parquet as pq


def codecs(path):
    meta = pq.ParquetFile(path).metadata
    return {
        meta.row_group(g).column(c).compression
        for g in range(meta.num_row_groups)
        for c in range(meta.num_columns)
    }


if __name__ == "__main__":
    found = codecs(sys.argv[1])
    print("codecs:", ", ".join(sorted(found)))
    sys.exit(1 if "BROTLI" in found else 0)

$ python parquet_codecs.py upload.parquet
codecs: BROTLI          # exit code 1: do not open it with this pyarrow
$ python parquet_codecs.py other.parquet
codecs: SNAPPY          # exit code 0

# conda-forge's libarrow links the shared libbrotlidec package,
# so updating that one package fixes pyarrow 25 and 26
conda install -c conda-forge "libbrotlidec>=1.2.1"