[CLSA-2026:1792824375] Fix CVE(s): CVE-2026-111497
Type:
security
Severity:
Critical
Release date:
2026-10-24 06:46:25 UTC
Description:
* SECURITY UPDATE: Out-of-bounds write via invalid block switch in the decoder - debian/patches/CVE-2026-111497.patch: return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH from DecodeBlockTypeAndLength and propagate it through the literal, command and distance block-switch wrappers in c/dec/decode.c, so a crafted stream aborts decoding instead of continuing with inconsistent block state - CVE-2026-111497
CVEs fixed:
Updated packages:
  • brotli_1.0.9-2+tuxcare.els1_amd64.deb
    sha:d6151553c7c6008ef26537e4d955cdf5aebe1504
  • libbrotli-dev_1.0.9-2+tuxcare.els1_amd64.deb
    sha:ae7b1f25c8c73e6d5f0beba80b45f2065461f029
  • libbrotli1_1.0.9-2+tuxcare.els1_amd64.deb
    sha:807acf6ab46209859d6a6fe19c079fbbfa0fbdac
  • python3-brotli_1.0.9-2+tuxcare.els1_amd64.deb
    sha:cc33405d25c44a09089695ef9a2c8ed4221e7215
  • brotli_1.0.9-2+tuxcare.els1_arm64.deb
    sha:30f47aca9e79799de6583b021821e543e5306e2a
  • libbrotli-dev_1.0.9-2+tuxcare.els1_arm64.deb
    sha:70955cbd7681e6da9fbc1585e79111f35ec9041c
  • libbrotli1_1.0.9-2+tuxcare.els1_arm64.deb
    sha:a9f6997d7668e0396a20891bb9ee0e3a641fcdbb
  • python3-brotli_1.0.9-2+tuxcare.els1_arm64.deb
    sha:fd95c4975ff2ec758b3df547b0763d3aee04ab3a
  • brotli_1.0.9-2+tuxcare.els1_armel.deb
    sha:f6207c6b0aa329783ad290feac14b6f7818b8c62
  • libbrotli-dev_1.0.9-2+tuxcare.els1_armel.deb
    sha:66221d5dccd70393e766e6d252edd60bc6926e18
  • libbrotli1_1.0.9-2+tuxcare.els1_armel.deb
    sha:fce3fef02e77bb6d4f56e6eecc3498f2cbd739b6
  • python3-brotli_1.0.9-2+tuxcare.els1_armel.deb
    sha:d37e68fcce3e49f3f18b880658d6e6d50073c63e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.