Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22183-1

Опубликовано: 29 окт. 2026
Источник: suse-cvrf

Описание

Security update for python-Brotli

This update for python-Brotli fixes the following issues:

  • CVE-2025-6176: denial of service (DoS) due to a flaw in its brotli decompression (bsc#1252945).
  • CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287779).

Update to 1.2.1:

  • decoder / encoder: added static initialization to reduce binary size
  • python: allow limiting decoder output (see SECURITY section)
  • python: modernize extension / allow multi-phase module initialization
  • decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)

Список пакетов

openSUSE Leap 16.0
python313-Brotli-1.2.1-160000.1.1

Ссылки

Описание

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

Затронутые продукты
openSUSE Leap 16.0:python313-Brotli-1.2.1-160000.1.1
Ссылки

Описание

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Затронутые продукты
openSUSE Leap 16.0:python313-Brotli-1.2.1-160000.1.1
Ссылки