[CLSA-2026:1792824525] Fix CVE(s): CVE-2026-111497
Type:
security
Severity:
Critical
Release date:
2026-10-24 06:48:56 UTC
Description:
* SECURITY UPDATE: Invalid stream not detected during block switch decoding - debian/patches/CVE-2026-111497.patch: return an error code from the literal/command/distance block-switch decoders and abort decoding with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c, c/include/brotli/decode.h - CVE-2026-111497
CVEs fixed:
Updated packages:
  • brotli_1.0.3-1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:9295cc40fb1d5dbfe4f31fec921af20e839a5c15
  • libbrotli-dev_1.0.3-1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:c581dc7e0fff21c0d7db14c60bed8ab83070056e
  • libbrotli1_1.0.3-1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:5fb32553c3ea165c93b0f08b2f43e5bef0d0314c
  • python-brotli_1.0.3-1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:1d94f64f5473941e27b992f7e3a7055a4fb163e0
  • python3-brotli_1.0.3-1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:4904935909efac11a433d5b5ca1d9bb500dc8493
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.