[CLSA-2026:1792824879] Fix CVE(s): CVE-2026-111497
Type:
security
Severity:
Critical
Release date:
2026-10-24 06:54:55 UTC
Description:
* SECURITY UPDATE: Invalid stream not detected during block switch decoding - debian/patches/CVE-2026-111497.patch: return an error code from the literal/command/distance block-switch decoders and abort decoding with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c, c/include/brotli/decode.h - CVE-2026-111497
CVEs fixed:
Updated packages:
  • brotli_1.0.3-1ubuntu1~16.04.2+tuxcare.els1_amd64.deb
    sha:48655fa9de659609ff93337fb8ef3d21a9536aa8
  • libbrotli-dev_1.0.3-1ubuntu1~16.04.2+tuxcare.els1_amd64.deb
    sha:df18f0b61ddd43e6ba5067d5beffb526417abfe0
  • libbrotli1_1.0.3-1ubuntu1~16.04.2+tuxcare.els1_amd64.deb
    sha:54661bf0344ee0c0ffe5ad63b07a8d9e92e49014
  • python-brotli_1.0.3-1ubuntu1~16.04.2+tuxcare.els1_amd64.deb
    sha:42eb2ab62e5efa4fad220298619b64d21b98bc0f
  • python3-brotli_1.0.3-1ubuntu1~16.04.2+tuxcare.els1_amd64.deb
    sha:26fd266cf3b71457ba1f7a4af0cab64c18493d2d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.