openSUSE-SU-2026:22183-1
openSUSE-SU-2026:22183-1 · Security update for python-Brotli
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for python-Brotli fixes the following issues: - CVE-2025-6176: denial of service (DoS) due to a flaw in its brotli decompression (bsc#1252945). - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287779). Update to 1.2.1: - **decoder / encoder: added static initialization to reduce binary size** - python: allow limiting decoder output (see SECURITY section) - python: modernize extension / allow multi-phase module initialization - decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)
Fix available
- Published
- Updated
Stack: system
Affected products and versions
python-brotli openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 1.2.1-160000.1.1
Update to 1.2.1-160000.1.1