Bug 2560274
| Summary: | CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder [fedora-f45] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mikel Olasagasti Uranga <mikel> |
| Component: | brotli | Assignee: | Jonathan Wright <jonathan> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 45 | CC: | carlwgeorge, eekopp, extras-qa, jan.public, jonathan, pnemade, pouar, sbalasub, tagoh |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | AcceptedBlocker {"flaws": ["e952c9d9-471d-4c9c-9b03-af60a2ac341b"]} | ||
| Fixed In Version: | brotli-1.2.1-1.fc45 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 2559478 | Environment: | |
| Last Closed: | 2026-10-26 22:25:49 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2559478 | ||
| Bug Blocks: | 2406954, 2558973 | ||
|
Description
Mikel Olasagasti Uranga
2026-10-24 10:34:15 UTC
Vuln info: https://broccoli2shell.com/ Packages that link against libbrotli: $ fedrq whatrequires -b f45 libbrotli -A x86_64 android-tools-1:37.0.0-4.fc45.x86_64 apitrace-14.0-2.fc45.x86_64 apitrace-gui-14.0-2.fc45.x86_64 brotli-1.2.0-6.fc45.x86_64 brotli-devel-1.2.0-6.fc45.x86_64 c-icap-libs-0.6.5-1.fc45.x86_64 ccache-4.13.6-3.fc45.x86_64 cef-146.0.11^chromium146.0.7680.177-6.fc45.x86_64 chromedriver-154.0.8037.97-1.fc45.x86_64 chromium-154.0.8037.97-1.fc45.x86_64 chromium-headless-154.0.8037.97-1.fc45.x86_64 cpprest-2.10.19-14.fc45.x86_64 dillo-3.3.0-3.fc45.x86_64 dotnet-apphost-pack-10.0-10.0.12-1.fc45.x86_64 dotnet-runtime-10.0-10.0.12-1.fc45.x86_64 dotnet-sdk-aot-10.0-10.0.112-1.fc45.x86_64 et-6.2.11-4.fc45.x86_64 exiv2-libs-0.28.9-1.fc45.x86_64 flamethrower-0.12.0-5.fc45.x86_64 freetype-2.14.3-2.fc45.x86_64 godot-4.7.1-1.fc45.x86_64 godot-runner-4.7.1-1.fc45.x86_64 httpd-2.4.68-7.fc45.x86_64 lemonade-server-11.5.2-1.fc45.x86_64 libarrow-23.0.1-11.fc45.x86_64 libcurl-8.21.0-6.fc45.x86_64 libheif-1.23.5-3.fc45.x86_64 libjxl-1:0.11.2-2.fc45.x86_64 libjxl-devtools-1:0.11.2-2.fc45.x86_64 libsoup-2.74.3-12.fc45.x86_64 libsoup3-3.7.3-1.fc45.x86_64 lighttpd-mod_deflate-1.4.85-3.fc45.x86_64 links-1:2.30-7.fc45.x86_64 lynx-2.9.3-4.fc45.x86_64 mupdf-libs-1.28.2-1.fc45.x86_64 nginx-mod-brotli-1.0.0~rc-14.fc45.x86_64 nheko-0.12.1-23.fc45.x86_64 nix-libs-2.35.2-1.fc45.x86_64 nodejs22-libs-1:22.23.1-4.fc45.x86_64 nodejs24-libs-1:24.18.0-4.fc45.x86_64 nodejs26-libs-1:26.3.1-5.fc45.x86_64 perl-Alien-Brotli-0.2.2-14.fc45.x86_64 perl-IO-Compress-Brotli-0.019000-7.fc45.x86_64 php-pecl-http-4.3.1-6.fc45.x86_64 python3-imagecodecs-2025.8.2-7.fc45.x86_64 qt6-qtbase-6.11.2-3.fc45.x86_64 trafficserver-10.2.0-1.fc45.x86_64 ugrep-7.8.2-2.fc45.x86_64 wget2-libs-2.2.1-3.fc45.x86_64 wireshark-cli-1:4.6.8-3.fc45.x86_64 woff2-1.0.2-26.fc45.x86_64 xpra-1:6.5.3-2.fc45.x86_64 Proposed as a Blocker for 45-final by Fedora user mikelo2 using the blocker tracking app because: CVE-2026-111497 is an unauthenticated Remote Code Execution (RCE) vulnerability in libbrotli (exploitable via compressed stream decoding, as detailed in https://broccoli2shell.com/). Because libbrotli is dynamically linked against critical default client and server networking stacks in Fedora 45, notably libcurl, qt6-qtbase, libsoup3, and web runtimes, any network operation decompressing an untrusted Brotli payload can trigger memory corruption leading to arbitrary code execution with the privileges of the running process. This exposes default desktop applications, system update utilities, and network daemons out-of-the-box on clean installs. For now I have done below, Side tag 'f45-build-side-157074' (id 157074) created. Building brotli-1.2.1-1.fc45 for f45-build-side-157074 Building perl-Alien-Brotli-0.2.2-15.fc45 for f45-build-side-157074 but not done anything after that. Feel free to proceed from here. FEDORA-2026-6a639d1308 (brotli-1.2.1-1.fc45 and perl-Alien-Brotli-0.2.2-15.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-6a639d1308 FEDORA-2026-6a639d1308 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-6a639d1308` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6a639d1308 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. AGREED AcceptedFinalBlocker Discussed at the 2026-10-26 (blocker / freeze exception) review meeting: This is accepted as a violation of “The release must contain no known security bugs of 'important' or higher impact according to the Red Hat severity classification scale which cannot be satisfactorily resolved by a package update,” as brotli is in the GNOME dependency chain and is potentially used in Workstation live sessions. https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-10-26/f45-blocker-review.2026-10-26-16.00.log.txt FEDORA-2026-6a639d1308 (brotli-1.2.1-1.fc45 and perl-Alien-Brotli-0.2.2-16.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. |