Your message dated Thu, 29 Oct 2026 13:17:06 +0000
with message-id <[email protected]>
and subject line Bug#1151690: fixed in brotli 1.1.0-2+deb13u1
has caused the Debian Bug report #1151690,
regarding brotli: CVE-2026-111497
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151690: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151690
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: brotli
Version: 1.1.0-2
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerability was published for brotli.
CVE-2026-111497[0]:
| A buffer overflow vulnerability in the Brotli decoder
| (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on
| all platforms allows a remote unauthenticated attacker to corrupt
| adjacent decoder state memory, disclose sensitive memory contents,
| cause a denial of service, or potentially execute arbitrary code
| using a crafted Brotli-compressed stream. Users need to update
| any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the
| latest available version: 1.0.10 or 1.1.1 or 1.2.1.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-111497
https://www.cve.org/CVERecord?id=CVE-2026-111497
[1]
https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6
[2]
https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: brotli
Source-Version: 1.1.0-2+deb13u1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
brotli, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated brotli package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 23 Oct 2026 05:22:51 +0200
Source: brotli
Architecture: source
Version: 1.1.0-2+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Tomasz Buchert <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1151690
Changes:
brotli (1.1.0-2+deb13u1) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Detect and report invalid stream earlier (CVE-2026-111497)
(Closes: #1151690)
Checksums-Sha1:
a3d0de606950140a8d02a17dc643e97743ce3093 2469 brotli_1.1.0-2+deb13u1.dsc
c1a06bd9cb912a8b5f07b2bd504af78ec6d0335c 512036 brotli_1.1.0.orig.tar.gz
01a075ff6eea245f1e32fea5ab42dcae8e9ff9a2 7764
brotli_1.1.0-2+deb13u1.debian.tar.xz
8281c22a63ee2702edad3098be8d5883630f8b32 5883
brotli_1.1.0-2+deb13u1_source.buildinfo
Checksums-Sha256:
64a1cd7422150e5c639d9892d6ffa837438b341f521e68ac4e75f6ef4eca49a2 2469
brotli_1.1.0-2+deb13u1.dsc
10973f4b4199eafa1d5735ef661ddb2ec2f97319ee9fd1824d4aabe08cff5265 512036
brotli_1.1.0.orig.tar.gz
848994612c6eb5e413d7df0e307ec7661855f5383c8cd10507e890fb7ee809ff 7764
brotli_1.1.0-2+deb13u1.debian.tar.xz
78117dbf6f36db79efefa981a6c6d3bf92cd809448d86fbae6d45aaff2edc38e 5883
brotli_1.1.0-2+deb13u1_source.buildinfo
Files:
26f9029d4fec68155db8e9db13a4e610 2469 python optional
brotli_1.1.0-2+deb13u1.dsc
97d4c95fcb7d5d6131c8d5a07eaa7d4b 512036 python optional
brotli_1.1.0.orig.tar.gz
f887dca20d1203b98a37ee08bb195057 7764 python optional
brotli_1.1.0-2+deb13u1.debian.tar.xz
cd39a238936252e6cdb80ef5a8d02056 5883 python optional
brotli_1.1.0-2+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrbVfpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EPHIQAJixJHDewolmfF6eL1PoO93Zd8N0R/Qz
3qi3V65PhG6loKuHX5FobRlhEXEpQxS6djbHymfOEg4mOYsIJO/+ggzD6NG7hAO3
hTJ3qjcTWbR39IwRWcV66pGFA+mwQd1qgoJOqWSIiAM/g4jpyVhW2ni72jhOZL3x
GXS3oZe9H5UhwGAtDGb6JQXYUaNaAVJPOSoKm+y/0JgMm7k+keJH83XIoqXCmYVq
yHibr52oB+ExfC3oa92ld8oVIuUoMtYvpyBr5tNjET3wuukqsM1snJH8/iENRfJW
EIip9NmD4kQAr8eM+aSfBB+dlMyq93cRAtDwj5zr9b8m3clWf1czoleBDz1MUcJN
vxRGNRmEXpJDg74y8vr3Yc/Ybqv9WabHqa2r6QFo3g7xjpN44aVCT4YmJ4/SiS45
1P+2owMeB4U7VELSmsKMZDwne1y6ZtPy8Pn4zTu+6Qz9F/mwkdONLOa1G+vcH3a9
Ml5OPK/BHpILdNqtVCmi1njDgjsxytPacdeBdjcdiq2yY4yrLs/iwYaQJ416OxLQ
m/hNtCDDVP2QduGNL683ATXHCOGfwIZ1oEiMnIO6T937z02Nzj73b1FveKkCKkex
75zuOqeIcJuOLC4AUpkhRAdi3YC3ENygUfWp2gEM1HAKjz+amL8OVss+JoVwEpfn
fh1AZVagZLEg
=bBpE
-----END PGP SIGNATURE-----
pgp8bIpuHugx5.pgp
Description: PGP signature
--- End Message ---
