OESA-2026-4602: python-brotlicffi security update

Q: Who is exposed to this issue?

Any deployment on any platform that uses a Brotli library or binary version 1.0.3 through 1.2.0 to decode Brotli-compressed data is affected. Exposure is especially relevant where the decoder processes remotely supplied compressed streams.

Q: What does an attacker need to exploit the vulnerability?

An attacker can exploit the issue remotely and without authentication by supplying a crafted Brotli-compressed stream to a vulnerable decoder. No user interaction is required.

Q: What should be updated?

Update Brotli libraries or binaries in the affected range to an available fixed version: 1.0.10, 1.1.1, or 1.2.1. The affected openEuler package is python-brotlicffi.

Q: How can I determine whether my environment is affected?

Inventory the Brotli libraries and binaries used by the application, including those reached through Python CFFI bindings, and check their versions. Versions from 1.0.3 through 1.2.0 should be treated as affected.

Published Oct 29, 2026

Updated

Python CFFI bindings to the Brotli library. Security Fix(es):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)

Affected Software

1 affected componentFixes available

openeuler/python-brotlicffi<1.1.0.0-2.oe2403sp3

1.1.0.0-2.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/python-brotlicffi to a version that resolves this vulnerability.
Fixed in 1.1.0.0-2.oe2403sp3
Upgrade
Upgrade python-brotlicffi to a version that resolves this vulnerability.
Fixed in 1.2.1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111497

Frequently Asked Questions

Who is exposed to this issue?

Any deployment on any platform that uses a Brotli library or binary version 1.0.3 through 1.2.0 to decode Brotli-compressed data is affected. Exposure is especially relevant where the decoder processes remotely supplied compressed streams.

What does an attacker need to exploit the vulnerability?

An attacker can exploit the issue remotely and without authentication by supplying a crafted Brotli-compressed stream to a vulnerable decoder. No user interaction is required.

What should be updated?

Update Brotli libraries or binaries in the affected range to an available fixed version: 1.0.10, 1.1.1, or 1.2.1. The affected openEuler package is python-brotlicffi.

How can I determine whether my environment is affected?

Inventory the Brotli libraries and binaries used by the application, including those reached through Python CFFI bindings, and check their versions. Versions from 1.0.3 through 1.2.0 should be treated as affected.

OESA-2026-4602: python-brotlicffi security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should be updated?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should be updated?

How can I determine whether my environment is affected?