This update for python-Brotli fixes the following issues:
- CVE-2025-6176: denial of service (DoS) due to a flaw in its brotli decompression (bsc#1252945).
- CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287779).
Update to 1.2.1:
- **decoder / encoder: added static initialization to reduce binary size**
- python: allow limiting decoder output (see SECURITY section)
- python: modernize extension / allow multi-phase module initialization
- decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#