Cyber ·
Brotli vulnerability (CVE-2026-111497) and list of affected projects
A list posted to the oss-sec mailing list on October 25, 2026 names other software projects that also include the Brotli library, some of which have already fixed the issue.
On October 25, 2026, Alan Coopersmith posted to the oss-sec mailing list an update on the vulnerability identified as CVE-2026-111497, related to the Brotli compression library. According to the text, the list gathers projects that also include Brotli. They include the .NET runtime, 7-Zip-zstd, Apache Arrow, Brotli4j, brotlicffi, CatBoost, Chromium, ClickHouse, DuckDB, EDK II, Firefox, Ghostscript, GraalJS, libjxl, MuPDF, NanaZip, ngx_brotli, p7zip, the Brotli extension for PHP, the Brotli gem for Ruby, SumatraPDF, UEFITool, v8-jsi, woff2, YDB and YTsaurus. The text says some of these projects have fixed the problem, but it does not detail which versions are fixed or the technical effects of the flaw. The source is a machine translation of a feed item from oss-sec. To verify, consult the original message on the oss-sec list, numbered 389 in the 2026 quarterly archive, the disclosure site cited in the message, and the release notes of each project.