Devdha opened a new pull request, #2725: URL: https://github.com/apache/orc/pull/2725
## Background CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, fixed in Brotli 1.2.1. `orc-core` decodes Brotli-compressed ORC streams through `BrotliCodec`, which uses brotli4j 1.23.0. That release bundles Brotli 1.2.0 and is therefore still vulnerable when reading an untrusted ORC file. brotli4j 1.24.0 upgrades the bundled native decoder to Brotli 1.2.1: - https://github.com/hyperxpro/Brotli4j/releases/tag/v1.24.0 - https://github.com/hyperxpro/Brotli4j/security/advisories/GHSA-x524-jrqf-vwq6 - Advisory for the CVE: https://patchtheplanet.org/brotli ## Change - Bump the `brotli4j.version` property from 1.23.0 to 1.24.0. No ORC API or file-format changes. ## Testing ``` cd java ./mvnw -pl core -am -Dtest=TestBrotli -Dsurefire.failIfNoSpecifiedTests=false test ``` `TestBrotli`: 5 tests, 0 failures, 0 errors. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
