https://seclists.org/oss-sec/2026/q4/390: Brotli CVE-2026-111497
Published Oct 26, 2026
·Updated
Affected Software
1 affected component
Google Brotli
Frequently Asked Questions
1
What fix should maintainers look for in bundled Brotli copies?
The referenced fix is the changes in Google Brotli commit 0ed4268a4401abcb4472096340477cf4af7d1a2b. Ghostscript 10.07.1rc1 is noted as having incorporated those changes into its bundled Brotli copy.
2
How can I check whether a bundled Brotli dependency has been remediated?
Compare the bundled Brotli source against the changes from commit 0ed4268a4401abcb4472096340477cf4af7d1a2b. For Ghostscript, the notice identifies version 10.07.1rc1 as containing the relevant changes.