Red Hat Security AdvisoryRHSA-2026:90888
brotli security, bug fix, and enhancement update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) brotli-1.0.9-6.el9_4.3, brotli-devel-1.0.9-6.el9_4.3, python3-brotli-1.0.9-6.el9_4.3
- Red Hat Enterprise Linux BaseOS E4S (v.9.4) brotli-1.0.9-6.el9_4.3, libbrotli-1.0.9-6.el9_4.3
Fixes 1 record
Priority CRITICAL 99KEV
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.82641 · Published 2026-10-22 · Partial fix · 1.0.10, 1.1.1 +2 CWE-252
