OESA-2026-4540: brotli security update

Q: Which deployments are exposed to this issue?

Deployments using Brotli libraries or binaries in versions 1.0.3 through 1.2.0 are affected on all platforms. Systems that decode Brotli-compressed data from remote sources are exposed to the described remote attack vector.

Q: What does an attacker need to exploit the vulnerability?

An attacker does not need authentication or user interaction. They need to supply a crafted Brotli-compressed stream to a vulnerable Brotli decoder.

Q: Are default installations affected?

The available information identifies affected versions rather than a particular configuration. Any installation using a Brotli library or binary from version 1.0.3 through 1.2.0 should be treated as affected.

Q: What should be done if a vulnerable version is found?

Update affected Brotli libraries or binaries to the latest available version identified in the advisory: 1.0.10, 1.1.1, or 1.2.1. Until updated, avoid decoding Brotli-compressed streams from remote or untrusted sources where possible.

Q: How can I determine whether a system is affected?

Inventory installed Brotli libraries and binaries and check their versions. Versions from 1.0.3 through 1.2.0 are vulnerable; the advisory identifies 1.0.10, 1.1.1, and 1.2.1 as updated versions.

Published Oct 29, 2026

Updated

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Affected Software

1 affected componentFixes available

openeuler/brotli<1.0.10-1.oe2203sp4

1.0.10-1.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/brotli to a version that resolves this vulnerability.
Fixed in 1.0.10-1.oe2203sp4
Upgrade
Upgrade Brotli to a version that resolves this vulnerability.
Fixed in 1.0.10
Upgrade
Upgrade Brotli to a version that resolves this vulnerability.
Fixed in 1.1.1
Upgrade
Upgrade Brotli to a version that resolves this vulnerability.
Fixed in 1.2.1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111497

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Brotli libraries or binaries in versions 1.0.3 through 1.2.0 are affected on all platforms. Systems that decode Brotli-compressed data from remote sources are exposed to the described remote attack vector.

What does an attacker need to exploit the vulnerability?

An attacker does not need authentication or user interaction. They need to supply a crafted Brotli-compressed stream to a vulnerable Brotli decoder.

Are default installations affected?

The available information identifies affected versions rather than a particular configuration. Any installation using a Brotli library or binary from version 1.0.3 through 1.2.0 should be treated as affected.

What should be done if a vulnerable version is found?

Update affected Brotli libraries or binaries to the latest available version identified in the advisory: 1.0.10, 1.1.1, or 1.2.1. Until updated, avoid decoding Brotli-compressed streams from remote or untrusted sources where possible.

How can I determine whether a system is affected?

Inventory installed Brotli libraries and binaries and check their versions. Versions from 1.0.3 through 1.2.0 are vulnerable; the advisory identifies 1.0.10, 1.1.1, and 1.2.1 as updated versions.

OESA-2026-4540: brotli security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are default installations affected?

What should be done if a vulnerable version is found?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are default installations affected?

What should be done if a vulnerable version is found?

How can I determine whether a system is affected?