Your message dated Sun, 25 Oct 2026 19:19:20 +0000
with message-id <[email protected]>
and subject line Bug#1151690: fixed in brotli 1.2.0-4.1
has caused the Debian Bug report #1151690,
regarding brotli: CVE-2026-111497
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151690: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151690
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: brotli
Version: 1.1.0-2
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerability was published for brotli.
CVE-2026-111497[0]:
| A buffer overflow vulnerability in the Brotli decoder
| (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on
| all platforms allows a remote unauthenticated attacker to corrupt
| adjacent decoder state memory, disclose sensitive memory contents,
| cause a denial of service, or potentially execute arbitrary code
| using a crafted Brotli-compressed stream. Users need to update
| any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the
| latest available version: 1.0.10 or 1.1.1 or 1.2.1.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-111497
https://www.cve.org/CVERecord?id=CVE-2026-111497
[1]
https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6
[2]
https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: brotli
Source-Version: 1.2.0-4.1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
brotli, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated brotli package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 23 Oct 2026 18:20:51 +0200
Source: brotli
Architecture: source
Version: 1.2.0-4.1
Distribution: unstable
Urgency: medium
Maintainer: Tomasz Buchert <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1151690
Changes:
brotli (1.2.0-4.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Detect and report invalid stream earlier (CVE-2026-111497)
(Closes: #1151690)
Checksums-Sha1:
087ff2aa9013c83655d8bd5591cd209ed6c0bb62 2426 brotli_1.2.0-4.1.dsc
0bc9c1113752cf119f8b481d2574c3b5dbcfa7ae 8552 brotli_1.2.0-4.1.debian.tar.xz
ff95c39157baef5c67494c57abe7d9e3c26ae6dd 5859 brotli_1.2.0-4.1_source.buildinfo
Checksums-Sha256:
1fbe86d3679744118e4ef6e2a2d0856028ecffb47a71a7689f1545b78ecde570 2426
brotli_1.2.0-4.1.dsc
154976a2a76ca7483d2f0012de67c8df7f8d2946b29214dd6d203174df1cb074 8552
brotli_1.2.0-4.1.debian.tar.xz
d6e0ce6711752ebbda6dfd64068b41dc88ab2f5b29e28bff0deea5dce593ae13 5859
brotli_1.2.0-4.1_source.buildinfo
Files:
822c735fa80f93a803ba1f22cf502a1d 2426 python optional brotli_1.2.0-4.1.dsc
abe7a2b1fbdac984edff258217644b57 8552 python optional
brotli_1.2.0-4.1.debian.tar.xz
6e4660f4a2f4293df0ce1fcf4f341449 5859 python optional
brotli_1.2.0-4.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrbrH5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EEwEQAIyHPMHlV8+81q1sDwfY88BbAYytZY0n
vdlmWXXZEnAoNKNNBJdAonmURQlqspHOHX60qXKU2F6ktJp010FKFdDLFCIYiB0n
jcYGdQSdZUVsk9GRpZPId+eetADvSDjRUE4S0XnnP5a4xs7xCUzQqqDMFdjkoU+I
KcuAkytAT7EdIzKVh2bh6Uq0jdlSNvxZ5wP8eeI0T3cM8vBY5DZm/0tdCHzAuhmi
XUC55mIuGU1EeGvLI/vA3ls4X3ChmrWKiSWCNVKpz6BgWcCvwG4SYo8KQzp/9GT1
aSATrKzGG/Y+/Q5hoBMr8MKm/42eWLbhtj5Vr99/PzfVR8mbsP/VzN2wSgFK0GGt
k7e2I1gOLI+oqA6dwkhb7Ga14b2ZqTdAU1sko7Y3bVzRHzxyUZgmCZF62QdXnULk
uutYFifiY4RtGbS0UHyF2FlIBgZWSEM/IssOrmCwVAb9VlVZbBB0KnT9vOLTODBo
Q3Vt75WvQJhkfzRFdty8RvyztHD4eVzFSR3/woArjJraGfYa2pgTUmCM2GzNqkWK
AefthizrL44K7clpNxICsmaVZ2DwYcmyp7v4n3ciz3JC2GGugrnmm6p2RdbB2XVx
gysqx+QimwTo9jp6OgBSmiuadH7wfdiutB0hB+l/BoptoN9DZmjm3QcAyvpyD/yz
r8XM9xd2abJo
=Hg9V
-----END PGP SIGNATURE-----
pgpbgCu5pyJoU.pgp
Description: PGP signature
--- End Message ---
