[6mile]

brotlic version 0.8.2 depends on brotlic-sys (^0.2.0). The
Cargo.lock distributed with brotlic 0.8.2 resolves that dependency to
brotlic-sys 0.2.2. The latter crate bundles Google's Brotli C source,
including brotli/c/dec/decode.c, and is used to provide Brotli
decompression functionality.

CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder's
block-type switch handling. A malformed Brotli stream can cause the decoder
to continue processing invalid state, potentially leading to memory
corruption, denial of service, or code execution in applications that
decompress attacker-controlled data.

[djc]

Let's remove this section.

[6mile]

To clarify, because you don't specifically say which section, I'm guessing you want everything under the "Source-level evidence" removed? Or, do you just want the section you've highlighted removed?

[6mile]

To be very clear: Rust users can still download and install this known-vulnerable package because you are nitpicking my PR and not clearly spelling out what you want me to change. I did follow the template, but maybe it needs updating?

[djc]

To clarify, because you don't specifically say which section, I'm guessing you want everything under the "Source-level evidence" removed? Or, do you just want the section you've highlighted removed?

Yes, everything under the "Source-level evidence" section.

To be very clear: Rust users can still download and install this known-vulnerable package because you are nitpicking my PR and not clearly spelling out what you want me to change.

To be very clear, advisories don't prevent users from downloading and installing known-vulnerable packages; and I review a lot of advisory PRs, which is only feasible when PRs contain all the necessary information.

I did follow the template, but maybe it needs updating?

You used the advisory template, but not the template for pull request descriptions that you'd get when you click the "New pull request" button.

[djc]

Please use the pull request template.