Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-8956-2 1 CVE

brotli vulnerability

Published Oct 27, 2026 · Updated Oct 29, 2026

Ecosystem: Ubuntu

Summary

USN-8956-1 fixed a vulnerability in Brotli. This update provides the
corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS brotli 1.0.3-1ubuntu1~16.04.2+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS brotli 1.0.3-1ubuntu1.3+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS brotli 1.0.7-6ubuntu0.1+esm1

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

References

  • report
    https://ubuntu.com/security/CVE-2026-111497