RLSA-2026:90495: Important: brotli security update

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates network reachability and no required privileges or user interaction. Exploitation has high attack complexity.

Q: What is the potential impact if exploitation succeeds?

The advisory rates the issue High with a CVSS score of 8.1. The vector indicates high potential impact to confidentiality, integrity, and availability.

Q: How can I determine whether my system is affected?

Review whether the Rocky Linux brotli package is installed and compare its installed update status with the security update identified by RLSA-2026:90495. The provided data does not include affected or fixed package version numbers.

Published Oct 29, 2026

Updated

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/brotli<0:1.0.9-10.el9_8.1

0:1.0.9-10.el9_8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/brotli to a version that resolves this vulnerability.
Fixed in 0:1.0.9-10.el9_8.1

Event History

Oct 29, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111497

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates network reachability and no required privileges or user interaction. Exploitation has high attack complexity.

What is the potential impact if exploitation succeeds?

The advisory rates the issue High with a CVSS score of 8.1. The vector indicates high potential impact to confidentiality, integrity, and availability.

How can I determine whether my system is affected?

Review whether the Rocky Linux brotli package is installed and compare its installed update status with the security update identified by RLSA-2026:90495. The provided data does not include affected or fixed package version numbers.

RLSA-2026:90495: Important: brotli security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

How can I determine whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

How can I determine whether my system is affected?