https://karmine05.github.io/dirtyfrag-blog/tags/envoy/ Recent content in Envoy on karmine's notes Hugo -- gohugo.io en dhruv@fleetdm.com (Dhruv Majumdar) dhruv@fleetdm.com (Dhruv Majumdar) © 2026 karmine's notes Mon, 26 Oct 2026 14:00:00 -0400 https://karmine05.github.io/dirtyfrag-blog/posts/http2shell-brotli-fleet/ Mon, 26 Oct 2026 14:00:00 -0400 dhruv@fleetdm.com (Dhruv Majumdar) https://karmine05.github.io/dirtyfrag-blog/posts/http2shell-brotli-fleet/ CVE-2026-111497 is a buffer overflow in Google’s Brotli decoder (1.0.3 to 1.2.0) that is compiled into Node.js, Bun, Envoy, Python Brotli wheels, .NET and the browsers. A crafted Content-Encoding: br body reaches it with no login. The upstream fix is tiny; finding every bundled copy is the work. This post ships six Fleet queries with version logic that does not trust SQLite string comparison, a policy pattern, and what the queries found on a real fleet (hint: Pillow bundles libbrotli 1.2.0).