Hi,

The following vulnerability was published for brotli.

CVE-2026-111497[0]:
| A buffer overflow vulnerability in the Brotli decoder
| (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on
| all platforms allows a remote unauthenticated attacker to corrupt
| adjacent decoder state memory, disclose sensitive memory contents,
| cause a denial of service, or potentially execute arbitrary code
| using a crafted Brotli-compressed stream.      Users need to update
| any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the
| latest available version: 1.0.10 or 1.1.1 or 1.2.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111497
https://www.cve.org/CVERecord?id=CVE-2026-111497
[1] https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6
[2] https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi,

For trixie-security did the attached debdiff, which is still as well
beeing tested against autopkgtest of reverse dependencies:
https://debusine.debian.net/debian/developers/work-request/1516700/

Regards,
Salvatore