RLSA-2026:90501: Important: brotli security update
Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.
Security Fix(es):
brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-5.el8_10
Event History
Frequently Asked Questions
What capabilities does successful exploitation provide?
The issue is rated high severity with a CVSS score of 8.1. The supplied vector indicates potential high impact to confidentiality, integrity, and availability.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates that no privileges are required and no user interaction is required. Exploitation is network-reachable, although the attack complexity is rated high.