Ubuntu fixes Brotli RCE and DoS flaws in four LTS and interim releases

Ubuntu has published security notice USN-8956-1 addressing a critical vulnerability in Brotli, the lossless compression library widely used for HTTP content encoding and package compression. The flaw, tracked as CVE-2026-111497, stems from improper handling of specially crafted compressed streams and exposes systems to remote denial of service or arbitrary code execution. Canonical has issued patched packages for all supported Ubuntu releases spanning 22.04 LTS through the interim 26.10 release, covering the command-line brotli utility, the libbrotli1 shared library, and the python3-brotli bindings.

The vulnerability is particularly significant because Brotli is embedded throughout the modern software stack, from web servers and browsers to package managers and application delivery pipelines. A remote attacker who can supply malicious compressed data to a vulnerable Brotli implementation could potentially compromise the decompressing process. Standard system updates will apply the fixes across all affected Ubuntu versions.

Vulnerability scope and patched versions

• CVE identifier: CVE-2026-111497 is the sole CVE referenced for this Brotli vulnerability.
• Defect class: Memory safety flaw in compressed stream parsing leading to incorrect handling of malformed input.
• Attack vector: Remote, unauthenticated; attacker supplies crafted compressed data to trigger crash or code execution.
• Affected packages: brotli (CLI utility), libbrotli1 (C shared library), and python3-brotli (Python bindings).
• Fixed versions: 1.2.0-4ubuntu0.1 (26.10), 1.2.0-3ubuntu0.1 (26.04 LTS), 1.1.0-2ubuntu0.1 (24.04 LTS), and 1.0.9-2ubuntu0.1 (22.04 LTS).

Why it matters

Brotli serves as a foundational compression layer across Linux distributions, powering web traffic optimization in nginx and Apache, accelerating package downloads, and enabling efficient static asset delivery for countless applications. Because the vulnerability permits remote code execution through a routine decompression operation, unpatched systems face elevated risk from any network path that accepts compressed data, including automated build pipelines, container image registries, and edge caching infrastructure.