OESA-2026-4601: python-brotlicffi security update
Python CFFI bindings to the Brotli library. Security Fix(es):
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python-brotlicffito a version that resolves this vulnerability.Fixed in 1.1.0.0-2.oe2403sp1 - Upgrade
Upgrade
Brotlito a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it by supplying a crafted Brotli-compressed stream to a vulnerable decoder. No user interaction or prior privileges are required.
Which Brotli versions need to be remediated?
Google Brotli versions 1.0.3 through 1.2.0 are affected on all platforms. Update Brotli libraries or binaries to an available fixed version: 1.0.10, 1.1.1, or 1.2.1.
What could exploitation cause?
Successful exploitation can corrupt adjacent decoder-state memory, disclose sensitive memory, or cause denial of service. It may also potentially allow arbitrary code execution.