Bug 2558973 (CVE-2026-111497)
| Summary: | CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, anthomas, aos-team-art-private, asdas, bbrownin, cchiang, csutherl, dbosanac, dpaolell, dranck, dschmidt, ehelms, ggainey, gotiwari, halshura, ikhan, jcantril, jclere, jdelft, jeanpoul, jhorak, jlanda, jorris, jpasqual, jreimann, jupierce, juwatts, jwong, kshier, lbrazdil, lgarciaa, mbiarnes, mdellweg, mdessi, medzrouga, mhulan, mminar, mrizzi, mvanderw, mvyas, nmoumoul, omaciel, osousa, pcattana, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, rbiba, rbobbitt, rchan, rekumar, rhel-process-autobot, rmontemayor, rojacob, sdawley, sghai, sidsharm, simaishi, smallamp, sskracic, stcannon, suppawar, szappis, tmalecek, tpfromme, ttakamiy, vchlup, vlaad, vvoronko, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | medzrouga:
needinfo?
(jorris) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2559459, 2559460, 2559461, 2559462, 2559463, 2559465, 2559466, 2559467, 2559468, 2559469, 2559470, 2559471, 2559472, 2559473, 2559474, 2559475, 2559476, 2559477, 2559478, 2559479, 2559480, 2559481, 2559482, 2559483, 2561960, 2560274 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-22 13:43:49 UTC
RHEL 8 `nodejs:24` bundles Brotli 1.2.0 in `libnode.so` (`bundled(brotli) = 1.2.0`, no link to the system `libbrotli`), which is inside the 1.0.3–1.2.0 range in this bug's description. The CVE page marks `nodejs:24/nodejs` as Not affected, and there's no nodejs tracker. Please re-evaluate." Additional detail: Node fixed CVE-2026-111497 in v24.22.1 by cherry-picking google/brotli 0ed4268a4401 into deps/brotli/c/dec/decode.c (nodejs/node commit 49dff6f57aa7) without changing version.h, which still says 1.2.0. nodejs-24.21.0's decode.c is byte-identical to upstream brotli v1.2.0, so it lacks the fix, and the nodejs-24.21.0-1.module+el8.10.0+24927 sources carry no brotli patch. The AlmaLinux rebuild's libnode.so uses the bundled decoder rather than the system libbrotli. The decoder is reachable through zlib.brotliDecompress / createBrotliDecompress and through fetch() with Content-Encoding: br, which this CVE's statement itself names. Please re-check nodejs:24 on RHEL 8. Upstream brotli fix (master branch): https://github.com/google/brotli/commit/0ed4268a4401abcb44720963 Upstream fixed in 1.2, 1.1, and 1.0 branches, as used in version 1.2.1, 1.1.1, and 1.0.10: https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6 https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:90449 https://access.redhat.com/errata/RHSA-2026:90449 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:90495 https://access.redhat.com/errata/RHSA-2026:90495 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:90501 https://access.redhat.com/errata/RHSA-2026:90501 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:90889 https://access.redhat.com/errata/RHSA-2026:90889 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:90893 https://access.redhat.com/errata/RHSA-2026:90893 @jorris thank you for the update and the follow up , two things are spotted on my end : - the latest UBI8 built today was using the unpatched brotli 1.0.6-4 ( link for the latest built https://catalog.redhat.com/en/software/containers/ubi8/5c647760bed8bd28d0e38f9f?image=6ae0728b331e520a65ff9977&architecture=amd64#packages ) - the other point is the OVAL feed is not reflecting that this is the patched release : https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/x86_64/baseos/os/Packages/b/brotli-1.0.6-5.el8_10.x86_64.rpm Thanks Mo This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:90888 https://access.redhat.com/errata/RHSA-2026:90888 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:90891 https://access.redhat.com/errata/RHSA-2026:90891 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:90892 https://access.redhat.com/errata/RHSA-2026:90892 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:90890 https://access.redhat.com/errata/RHSA-2026:90890 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:90914 https://access.redhat.com/errata/RHSA-2026:90914 |