@cdxgen/cdxgen 13.4.0 → 13.6.0

package/data/queries.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "deb_packages": {
     "query": "select * from deb_packages;",
     "description": "Retrieves all the installed DEB packages in the target Linux system.",
@@ -69,6 +81,29 @@
     "description": "Retrieves all the installed RPM packages in the target Linux system.",
     "purlType": "rpm"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages;",
+    "description": "Retrieves all the packages pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm"
+  },
+  "snap_packages": {
+    "query": "select * from snap_packages;",
+    "description": "Retrieves the installed snap packages at their current revision.",
+    "purlType": "snap",
+    "componentType": "application"
+  },
+  "flatpak_packages": {
+    "query": "select app_id as name, name as display_name, version, arch, branch, commit_hash, origin, runtime, type, installation, summary, description, license, homepage, developer_name from flatpak_packages;",
+    "description": "Retrieves the Flatpak applications and runtimes installed system-wide and for each user.",
+    "purlType": "flatpak",
+    "componentType": "application"
+  },
+  "homebrew_packages": {
+    "query": "SELECT * FROM homebrew_packages;",
+    "description": "Homebrew formula and cask inventory including auto-update behavior.",
+    "purlType": "brew",
+    "componentType": "application"
+  },
   "python_packages": {
     "query": "select * from python_packages;",
     "description": "Python packages installed on system.",
@@ -85,6 +120,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, shell, uid, gid FROM users;",
     "description": "Local user inventory for account and shell posture analysis.",

package/data/remediations.json

@@ -111,6 +111,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "jvm.maven.tooling-disabled": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Maven was skipped because dependency installation is disabled; only the direct dependencies declared in pom.xml files were captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Maven. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Maven without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.maven.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
   "jvm.gradle.unresolved-config": {
     "ecosystem": "java",
     "kind": "fallback.engaged",
@@ -407,6 +431,34 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "js.lockfile-unsafe-path": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "Secure mode omitted package-lock.json entries whose paths point outside the project",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Review the file: and link entries the warning names; remove any you did not add, and regenerate the lockfile with npm install --package-lock-only"
+      },
+      {
+        "kind": "config",
+        "command": "For trusted sibling file: or npm link dependencies, rerun outside secure mode on a trusted checkout to keep them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.lockfile-unsafe-path"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "js.pnpm-lock-unparseable": {
     "ecosystem": "npm",
     "kind": "evidence.degraded",
@@ -615,6 +667,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "python.poetry-export.tooling-disabled": {
+    "ecosystem": "python",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "poetry export and pdm export were skipped because dependency installation is disabled; only the packages in the lock file were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Poetry or PDM. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Poetry or PDM without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "python.poetry-export.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "clojure.lein.missing": {
     "ecosystem": "clojure",
     "kind": "fallback.engaged",
@@ -672,6 +748,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "clojure.lein.tooling-disabled": {
+    "ecosystem": "clojure",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Leiningen was skipped because dependency installation is disabled; only the dependencies declared in project.clj were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Leiningen. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Leiningen without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "clojure.lein.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "swift.toolchain.missing": {
     "ecosystem": "swift",
     "kind": "fallback.engaged",
@@ -718,11 +818,35 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "swift.tooling-disabled": {
+    "ecosystem": "swift",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "SwiftPM was skipped because dependency installation is disabled; only the packages in Package.resolved were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run SwiftPM. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs SwiftPM without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "swift.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "dotnet.sdk.missing": {
     "ecosystem": "csharp",
     "kind": "evidence.degraded",
     "impact": "components",
-    "title": ".NET SDK is not installed, so dotnet slices are degraded",
+    "title": "The .NET runtime dosai needs is not installed, so dotnet slices are degraded",
     "targetTier": "resolved",
     "actions": [
       {
@@ -749,6 +873,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "dotnet.msbuild.tooling-disabled": {
+    "ecosystem": "csharp",
+    "kind": "fallback.engaged",
+    "impact": "versions",
+    "title": "dotnet msbuild was skipped because dependency installation is disabled; package versions set by MSBuild properties that no project or props file defines are empty",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run MSBuild. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs MSBuild without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "dotnet.msbuild.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "dosai.semantics.persist-failed": {
     "ecosystem": "csharp",
     "kind": "evidence.degraded",
@@ -773,6 +921,72 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
   },
+  "dosai.semantics.trimmed-report": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "none",
+    "title": "The persisted dosai report is partial: its methods half was written with --sections",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Run dosai methods without --sections, or run cdxgen with --evidence, so the persisted report holds every section."
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.semantics.trimmed-report"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
+  "dosai.usages.trimmed-report": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The supplied dosai usages slice was written without sections cdxgen reads",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Run dosai methods without --sections, or with every section cdxgen reads, for the report passed with --usages-slices-file."
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.usages.trimmed-report"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
+  "dosai.method-calls-capped": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The dosai report holds more distinct method calls than cdxgen keeps, so some occurrence evidence was dropped",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Raise the cap with CDXGEN_DOSAI_MAX_METHOD_CALLS, or write the report with dosai's --sections so it holds less."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.method-calls-capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -796,6 +1010,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "cocoa.podfile-json.tooling-disabled": {
+    "ecosystem": "cocoa",
+    "kind": "fallback.engaged",
+    "impact": "components",
+    "title": "pod ipc podfile-json was skipped because dependency installation is disabled; every pod from Podfile.lock is included without per-target filtering",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run CocoaPods. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs CocoaPods without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "cocoa.podfile-json.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "cocoa.podspec.tooling-disabled": {
+    "ecosystem": "cocoa",
+    "kind": "fallback.engaged",
+    "impact": "licenses",
+    "title": "Ruby podspecs were not evaluated because dependency installation is disabled; their pods lack license and author details",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run CocoaPods. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs CocoaPods without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "cocoa.podspec.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "ruby.build-deps.missing": {
     "ecosystem": "ruby",
     "kind": "evidence.degraded",
@@ -1048,6 +1310,102 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
   },
+  "php.host-probe.package-db-unreadable": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the PHP no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so PHP files can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "php.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
+  "ruby.host-probe.package-db-unreadable": {
+    "ecosystem": "ruby",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Ruby no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so Ruby files can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "ruby.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=ruby"
+  },
+  "npm.host-probe.package-db-unreadable": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Node.js no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so node binaries can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "npm.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/OBOM_LESSONS"
+  },
+  "php.composer.platform-unattributed": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "A composer.lock below the scanned directory sits beside a composer.json without a name, so its PHP and extension requirements were not recorded",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Give the project a \"name\" in its composer.json, or scan the project directory itself"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "php.composer.platform-unattributed"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
   "dart.pub-get-needed": {
     "ecosystem": "dart",
     "kind": "evidence.degraded",
@@ -1143,6 +1501,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "binary.brotli-probe.capped": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The Brotli decoder probe reached its file or byte cap, so some native files were not read for an embedded decoder",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Scan the image or root filesystem in smaller parts (for example one application directory at a time with -t rootfs), so every native file is read for an embedded Brotli decoder"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "binary.brotli-probe.capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/BOM_AUDIT?id=brotli-security"
+  },
+  "os.apk-installed-db.unreadable": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The apk installed database could not be read in full, so the packages of this host are missing from the OBOM",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the apk installed database (for example as root), so the packages it lists are inventoried"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "os.apk-installed-db.unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "policy.secure-mode": {
     "ecosystem": "generic",
     "kind": "evidence.degraded",

package/data/rules/ai-bom.yaml

@@ -330,7 +330,7 @@
     components[
       type = 'machine-learning-model'
       and $prop($, 'cdx:ai:artifactFormat') = 'onnx'
-      and not $hasProp($, 'cdx:onnx:producer')
+      and $not($hasProp($, 'cdx:onnx:producer'))
     ]
   location: |
     {

package/data/rules/brotli-decoder.yaml

@@ -0,0 +1,107 @@
+# Embedded Brotli decoder rules
+# Category: brotli-security
+# Evaluates the cdx:brotli:* properties recorded for native files (container,
+# rootfs and OS scans) and vendored source trees (C/C++ source scans).
+# CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder
+# (CWE-252, CWE-787) reachable from any Brotli stream an attacker controls:
+# an HTTP response a client decodes, a request body a server inflates, a
+# compressed file. Fixed in google/brotli 1.0.10, 1.1.1 and 1.2.1 (commit
+# 0ed4268). The Go port, andybalholm/brotli, had the same logic error but
+# only crashes; it is fixed in v1.2.7.
+# https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
+#
+# The fix is read from the decoder itself (its BLOCK_SWITCH error name), not
+# from a version number, so a distro backport that keeps the old version is
+# recognised as fixed and a Node.js that still reports brotli 1.2.0 after the
+# fix is not flagged.
+
+- id: BROTLI-RCE-001
+  name: "Native file embeds a Brotli decoder affected by CVE-2026-111497"
+  description: "A binary, shared library or extension module carries its own copy of Google's C Brotli decoder without the fix for CVE-2026-111497. Updating the system libbrotli does not fix a private copy: the file itself has to be replaced by a release built from a fixed decoder."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+      and $not($hasProp($, 'cdx:vendored', 'true'))
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder without the CVE-2026-111497 fix; a crafted Brotli stream can write past a decoder buffer (possible code execution). {{ $hasProp($, 'cdx:node:buildVersion') ? 'Upgrade Node.js ' & $prop($, 'cdx:node:buildVersion') & ' to 22.23.4, 24.22.1, 26.12.1 or later.' : 'Replace it with a build that bundles brotli 1.0.10, 1.1.1 or 1.2.1 (or google/brotli commit 0ed4268).' }}"
+  mitigation: "Node.js: 22.23.4, 24.22.1, 26.12.1. Python: Brotli 1.2.1, brotlicffi 1.2.1.0. Ruby: brotli gem 0.9.2. Java: Brotli4j 1.24.0. Other software: a release that bundles brotli 1.0.10, 1.1.1 or 1.2.1, or a rebuild with google/brotli commit 0ed4268. Until then, reject Content-Encoding: br request bodies at the proxy and keep untrusted Brotli data away from the affected process."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence'),
+      "nodeVersion": $prop($, 'cdx:node:buildVersion')
+    }
+
+- id: BROTLI-RCE-002
+  name: "Vendored Brotli source affected by CVE-2026-111497"
+  description: "The project carries a copy of Google's Brotli sources whose decoder lacks the fix for CVE-2026-111497. Everything built from this tree inherits the bug, and no package manager or distro update will reach it."
+  severity: high
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:vendored', 'true')
+      and $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Vendored Brotli {{ version }} at '{{ $prop($, 'cdx:vendored:path') }}' lacks the CVE-2026-111497 fix; update it to 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268."
+  mitigation: "Update the vendored copy to brotli 1.0.10, 1.1.1 or 1.2.1, or cherry-pick google/brotli commit 0ed4268 (with 50a9b70, b418fa8 and da98063), then rebuild everything that links it."
+  evidence: |
+    {
+      "path": $prop($, 'cdx:vendored:path'),
+      "version": version,
+      "versionSource": $prop($, 'cdx:vendored:versionSource')
+    }
+
+- id: BROTLI-DOS-001
+  name: "Go binary embeds a Brotli port affected by the CVE-2026-111497 logic error"
+  description: "The Go port of the Brotli decoder (github.com/andybalholm/brotli) before v1.2.7 has the same unchecked block-switch error as the C decoder. Go's bounds checks turn it into a panic rather than a memory write, so a crafted stream crashes the process."
+  severity: medium
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:go:blockSwitchFix', 'false')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds github.com/andybalholm/brotli older than v1.2.7; a crafted Brotli stream makes it panic. Rebuild with v1.2.7 or later."
+  mitigation: "Update github.com/andybalholm/brotli to v1.2.7 or later and rebuild the binary."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: BROTLI-RCE-003
+  name: "Native file embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read"
+  description: "A binary, shared library or extension module carries Google's C Brotli decoder, recognised by its decoding tables, but the linker dropped the error-name table that shows whether the fix is in (--gc-sections, LTO and -dead_strip do this when nothing calls BrotliDecoderErrorString). Whether the copy is vulnerable has to be settled from the release that built the file."
+  severity: low
+  category: brotli-security
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:brotli:c:blockSwitchFix', 'unknown')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "'{{ name }}' embeds a Brotli decoder whose CVE-2026-111497 fix state cannot be read from the file; check that it was built from brotli 1.0.10, 1.1.1, 1.2.1 or later, or with google/brotli commit 0ed4268."
+  mitigation: "Find the release the file belongs to and confirm it bundles a fixed decoder (brotli 1.0.10, 1.1.1, 1.2.1, or commit 0ed4268); replace it otherwise."
+  evidence: |
+    {
+      "srcFile": $prop($, 'internal:SrcFile'),
+      "evidence": $prop($, 'cdx:brotli:c:evidence')
+    }