Fedora Account System
Red Hat Associate
Red Hat Customer
+++ This bug was initially created as a clone of Bug #2559478 +++ Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Vuln info: https://broccoli2shell.com/ Packages that link against libbrotli: $ fedrq whatrequires -b f45 libbrotli -A x86_64 android-tools-1:37.0.0-4.fc45.x86_64 apitrace-14.0-2.fc45.x86_64 apitrace-gui-14.0-2.fc45.x86_64 brotli-1.2.0-6.fc45.x86_64 brotli-devel-1.2.0-6.fc45.x86_64 c-icap-libs-0.6.5-1.fc45.x86_64 ccache-4.13.6-3.fc45.x86_64 cef-146.0.11^chromium146.0.7680.177-6.fc45.x86_64 chromedriver-154.0.8037.97-1.fc45.x86_64 chromium-154.0.8037.97-1.fc45.x86_64 chromium-headless-154.0.8037.97-1.fc45.x86_64 cpprest-2.10.19-14.fc45.x86_64 dillo-3.3.0-3.fc45.x86_64 dotnet-apphost-pack-10.0-10.0.12-1.fc45.x86_64 dotnet-runtime-10.0-10.0.12-1.fc45.x86_64 dotnet-sdk-aot-10.0-10.0.112-1.fc45.x86_64 et-6.2.11-4.fc45.x86_64 exiv2-libs-0.28.9-1.fc45.x86_64 flamethrower-0.12.0-5.fc45.x86_64 freetype-2.14.3-2.fc45.x86_64 godot-4.7.1-1.fc45.x86_64 godot-runner-4.7.1-1.fc45.x86_64 httpd-2.4.68-7.fc45.x86_64 lemonade-server-11.5.2-1.fc45.x86_64 libarrow-23.0.1-11.fc45.x86_64 libcurl-8.21.0-6.fc45.x86_64 libheif-1.23.5-3.fc45.x86_64 libjxl-1:0.11.2-2.fc45.x86_64 libjxl-devtools-1:0.11.2-2.fc45.x86_64 libsoup-2.74.3-12.fc45.x86_64 libsoup3-3.7.3-1.fc45.x86_64 lighttpd-mod_deflate-1.4.85-3.fc45.x86_64 links-1:2.30-7.fc45.x86_64 lynx-2.9.3-4.fc45.x86_64 mupdf-libs-1.28.2-1.fc45.x86_64 nginx-mod-brotli-1.0.0~rc-14.fc45.x86_64 nheko-0.12.1-23.fc45.x86_64 nix-libs-2.35.2-1.fc45.x86_64 nodejs22-libs-1:22.23.1-4.fc45.x86_64 nodejs24-libs-1:24.18.0-4.fc45.x86_64 nodejs26-libs-1:26.3.1-5.fc45.x86_64 perl-Alien-Brotli-0.2.2-14.fc45.x86_64 perl-IO-Compress-Brotli-0.019000-7.fc45.x86_64 php-pecl-http-4.3.1-6.fc45.x86_64 python3-imagecodecs-2025.8.2-7.fc45.x86_64 qt6-qtbase-6.11.2-3.fc45.x86_64 trafficserver-10.2.0-1.fc45.x86_64 ugrep-7.8.2-2.fc45.x86_64 wget2-libs-2.2.1-3.fc45.x86_64 wireshark-cli-1:4.6.8-3.fc45.x86_64 woff2-1.0.2-26.fc45.x86_64 xpra-1:6.5.3-2.fc45.x86_64
Proposed as a Blocker for 45-final by Fedora user mikelo2 using the blocker tracking app because: CVE-2026-111497 is an unauthenticated Remote Code Execution (RCE) vulnerability in libbrotli (exploitable via compressed stream decoding, as detailed in https://broccoli2shell.com/). Because libbrotli is dynamically linked against critical default client and server networking stacks in Fedora 45, notably libcurl, qt6-qtbase, libsoup3, and web runtimes, any network operation decompressing an untrusted Brotli payload can trigger memory corruption leading to arbitrary code execution with the privileges of the running process. This exposes default desktop applications, system update utilities, and network daemons out-of-the-box on clean installs.
For now I have done below, Side tag 'f45-build-side-157074' (id 157074) created. Building brotli-1.2.1-1.fc45 for f45-build-side-157074 Building perl-Alien-Brotli-0.2.2-15.fc45 for f45-build-side-157074 but not done anything after that. Feel free to proceed from here.
FEDORA-2026-6a639d1308 (brotli-1.2.1-1.fc45 and perl-Alien-Brotli-0.2.2-15.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-6a639d1308
FEDORA-2026-6a639d1308 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-6a639d1308` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6a639d1308 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
AGREED AcceptedFinalBlocker Discussed at the 2026-10-26 (blocker / freeze exception) review meeting: This is accepted as a violation of “The release must contain no known security bugs of 'important' or higher impact according to the Red Hat severity classification scale which cannot be satisfactorily resolved by a package update,” as brotli is in the GNOME dependency chain and is potentially used in Workstation live sessions. https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-10-26/f45-blocker-review.2026-10-26-16.00.log.txt
FEDORA-2026-6a639d1308 (brotli-1.2.1-1.fc45 and perl-Alien-Brotli-0.2.2-16.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.