Package: mono Version: 6.14.1+ds2-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected]
Dear Maintainer, The mono source package ships an embedded copy of Google Brotli in external/corefx/src/Native/AnyOS/brotli/ (common/version.h: BROTLI_VERSION 0x1000009, i.e. Brotli 1.0.9). This version is within the range affected by CVE-2026-111497, an out-of-bounds write in the Brotli decoder (c/dec/decode.c), which affects Brotli 1.0.3 through 1.2.0 according to the Debian security tracker. The embedded copy does not contain the upstream fix: dec/decode.c still has BROTLI_SAFE(DecodeCommandBlockSwitch(s)) and DecodeBlockTypeAndLength still returns BROTLI_BOOL. The system library is tracked in #1151685. The upstream fix is in these commits: - v1.2.1: https://github.com/google/brotli/commit/b418fa81 - v1.1.1: https://github.com/google/brotli/commit/da980636 - v1.0.10: https://github.com/google/brotli/commit/50a9b70a mono does not Build-Depend on libbrotli-dev and debian/rules does not mention brotli, so the embedded copy appears to be what gets built. I have not verified that the resulting binaries link it, so please check whether the native compression library is built from this copy. If it is, System.IO.Compression.BrotliStream can decode untrusted input. Suggested fix: backport the upstream fix (commit 50a9b70a applies to the 1.0.x line) or build against the system libbrotli once it is fixed. This was found while scanning the Debian source archive for embedded copies of vulnerable code (Google Summer of Code 2026 project with Bastien Roucariès). Thanks for your work on mono. Best regards, Gajendra Nath Soren
