Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-8956-1 1 CVE

brotli vulnerability

Published Oct 26, 2026 · Updated Oct 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS brotli 1.0.9-2ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS brotli 1.1.0-2ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS brotli 1.2.0-3ubuntu0.1
Ubuntu · 26.10 brotli 1.2.0-4ubuntu0.1

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

References

  • report
    https://ubuntu.com/security/CVE-2026-111497