Repository navigation
Bump github.com/andybalholm/brotli to v1.2.7 (CVE-2026-111497, CISA KEV) and release #961
Description
The backend binaries of the latest release, v3.5.0 (altinity-clickhouse-plugin_{linux,darwin}_{amd64,arm64,arm}), are built with github.com/andybalholm/brotli v1.2.2. master is on v1.2.4. Both are affected by CVE-2026-111497 ("Broccoli2Shell"), an out-of-bounds write in the Brotli decoder that can corrupt memory, leak data or lead to remote code execution through a crafted Brotli stream.
- CVSS 9.8 (NVD) / 9.2 (CNA), listed in CISA KEV (exploited in the wild), EPSS ~0.83
- Go advisory: GO-2026-6888 / GHSA-c9gr-gmg4-2vqv, fixed in v1.2.7
Exploiting this through the plugin is probably hard, because the decoder only sees data coming back from the ClickHouse server it is configured to use. Even so, every vulnerability scanner flags the plugin as CRITICAL / KEV on every Grafana host or volume that installs it, and users can't patch a vendored Go dependency themselves.
Could you bump github.com/andybalholm/brotli to ≥ v1.2.7 and cut a release (v3.5.1)? A bump on master alone doesn't help, because the scanners look at the released plugin. Happy to open the PR if that helps.
Activity