Read the docs
TI-2026-79288 Aliases CVE-2026-111497GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

Priority CRITICAL 99Exploited in the wildCWE-252Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 58 fixed, 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

A buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0, on all platforms, lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory, cause a denial of service, or potentially execute arbitrary code with a crafted Brotli-compressed stream. CISA added the flaw to KEV on 2026-10-27 with a due date of 2026-11-10, and rates exploitation as active. The CVSS 4.0 base score is 9.2 (Critical).

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-27CISA due date 2026-11-10
EPSS 0.82641 99th percentileScored 2026-11-07
Fix Partial Brotli (Google): 1.0.10, 1.1.1, 1.2.1brotli (PyPI): 1.2.1+1 more productRed Hat: 84 advisoriesRed Hat: 58 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleBrotli1.0.3 to before 1.0.10; 1.1.0 to before 1.1.1; 1.2.0 to before 1.2.11.0.10, 1.1.1, 1.2.1Patch availableCNA
—brotli (PyPI)1.0.3 to before 1.2.11.2.1Patch availableGHSA-9v8h-qqgm-4m35
—brotlicffi (PyPI)1.0.3 to before 1.2.1.01.2.1.0Patch availableGHSA-9v8h-qqgm-4m35
  • Brotli VendorGoogle Affected 1.0.3 to before 1.0.10; 1.1.0 to before 1.1.1; 1.2.0 to before 1.2.1 Fixed in 1.0.10, 1.1.1, 1.2.1 Patch available CNA
  • brotli (PyPI) Vendor— Affected 1.0.3 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-9v8h-qqgm-4m35
  • brotlicffi (PyPI) Vendor— Affected 1.0.3 to before 1.2.1.0 Fixed in 1.2.1.0 Patch available GHSA-9v8h-qqgm-4m35

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*1.0.3 to before 1.0.10; 1.1.0 to before 1.1.1; 1.2.0 to before 1.2.1VulnerableGoogle
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*before 22.23.4; 23.0.0 to before 24.22.1; 25.0.0 to before 26.12.1VulnerableNodeJS
cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*before 1.2.1.0Vulnerablepython-hyper
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*8.0.0 to before 8.0.33; 9.0.0 to before 9.0.22; 10.0.0 to before 10.0.14VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*11.0.0 preview1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*11.0.0 preview2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*11.0.0 preview3VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*11.0.0 preview4VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*11.0.0 preview5VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*11.0.0 preview6VulnerableMicrosoft
  • cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:* Versions 1.0.3 to before 1.0.10; 1.1.0 to before 1.1.1; 1.2.0 to before 1.2.1 Vulnerable ·Google
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions before 22.23.4; 23.0.0 to before 24.22.1; 25.0.0 to before 26.12.1 Vulnerable ·NodeJS
  • cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:* Versions before 1.2.1.0 Vulnerable ·python-hyper
  • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.33; 9.0.0 to before 9.0.22; 10.0.0 to before 10.0.14 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:* Versions 11.0.0 preview1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:* Versions 11.0.0 preview2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:* Versions 11.0.0 preview3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:* Versions 11.0.0 preview4 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:* Versions 11.0.0 preview5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:* Versions 11.0.0 preview6 Vulnerable ·Microsoft
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*11.0.0 preview7VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*11.0.0 rc1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*11.0.0 rc2VulnerableMicrosoft
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*before 1.29.9; 1.30.0 to before 1.30.6; 1.31.0 to before 1.31.2Vulnerableistio
cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*before 1.4.4Vulnerableanthropics
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*before 1.37.8; 1.38.0 to before 1.38.6; 1.39.0 to before 1.39.3Vulnerableenvoyproxy
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*up to 202608VulnerableTianoCore
cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*not specified by NVDVulnerableGoogle
cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*up to 2.0.0Vulnerableduckdb
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*up to 26.10.2.103VulnerableClickHouse
cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*up to 26.0.0VulnerableApache
cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*27.0.0 devVulnerableApache
cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*up to 26.02-1.5.7-r2Vulnerablemcmilk
cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*up to 16.02Vulnerable7-Zip
cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*before 1.2.7VulnerableAndybalholm
cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
  • cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:* Versions 11.0.0 preview7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:* Versions 11.0.0 rc1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:* Versions 11.0.0 rc2 Vulnerable ·Microsoft
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* Versions before 1.29.9; 1.30.0 to before 1.30.6; 1.31.0 to before 1.31.2 Vulnerable ·istio
  • cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·anthropics
  • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions before 1.37.8; 1.38.0 to before 1.38.6; 1.39.0 to before 1.39.3 Vulnerable ·envoyproxy
  • cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* Versions up to 202608 Vulnerable ·TianoCore
  • cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Google
  • cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:* Versions up to 2.0.0 Vulnerable ·duckdb
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* Versions up to 26.10.2.103 Vulnerable ·ClickHouse
  • cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:* Versions up to 26.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:* Versions 27.0.0 dev Vulnerable ·Apache
  • cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:* Versions up to 26.02-1.5.7-r2 Vulnerable ·mcmilk
  • cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:* Versions up to 16.02 Vulnerable ·7-Zip
  • cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:* Versions before 1.2.7 Vulnerable ·Andybalholm
  • cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens

Remediation

Update Brotli to 1.0.10, 1.1.1 or 1.2.1, the fixed release for each affected branch. PyPI users should install brotli 1.2.1 and brotlicffi 1.2.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA Brotli (Google) Fixed in 1.0.10, 1.1.1, 1.2.1
  • Fix · GHSA-9v8h-qqgm-4m35 brotli (PyPI) Fixed in 1.2.1 Advisory →
  • Fix · GHSA-9v8h-qqgm-4m35 brotlicffi (PyPI) Fixed in 1.2.1.0 Advisory →

Red Hat 84 advisories

  • RHSA-2026:95346 Released 2026-11-06 · Red Hat rating Critical
    OpenShift Container Platform 4.22.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202611032353-0, rhcos-ppc64le-4.22.9.8.202611032353-0, rhcos-s390x-4.22.9.8.202611032353-0 +1
  • RHSA-2026:95655 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.32.0-1.el8sat, openvox-server-8.18.0-1.el8sat, python-brotli-1.2.1-1.el8pc +11
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +11
  • RHSA-2026:95657 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.18 security update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +4
Show 81 more Red Hat advisories
  • RHSA-2026:95656 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +9
  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:94476 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.8 (CUDA)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:94474 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.5.6 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:94473 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:94472 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:94471 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:94470 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:94469 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:94468 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.7 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:94467 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:94466 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (ROCm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:94465 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:94464 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:94463 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (Spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:94462 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94461 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:94460 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:94459 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.8 (CPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94458 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (TPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94455 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94454 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94453 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:94452 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94457 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:94108 Released 2026-11-02 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9
  • RHSA-2026:93980 Released 2026-11-02 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available
    • Red Hat Build of Apache Camel 3.33.4.SP2 com.aayushatharva.brotli4j.native-linux-x86_64-1.24.0.redhat-00001.jar
  • RHSA-2026:94100 Released 2026-11-02 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-brotli-1.2.1-1.el8ap
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-brotli-1.2.1-1.el9ap
  • RHSA-2026:94101 Released 2026-11-02 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-brotli-1.2.1-1.el9ap
  • RHSA-2026:93902 Released 2026-11-02 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4.SP2 release and security update
    • Red Hat build of Quarkus 3.33.4.SP2
  • RHSA-2026:93908 Released 2026-11-02 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6.SP2 release and security update
    • Red Hat build of Quarkus 3.27.6.SP2
  • RHSA-2026:93987 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.31.2 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/code-sshd-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +5
  • RHSA-2026:93984 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.31.2 RHEL 10 Container Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/udi-base-rhel10
  • RHSA-2026:93550 Released 2026-11-02 · Red Hat rating Important
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-trustyai-service-rhel9
  • RHSA-2026:93457 Released 2026-11-02 · Red Hat rating Important
    .NET 8.0 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.33-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.33-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.33-1.el9_6 +9
  • RHSA-2026:93456 Released 2026-11-02 · Red Hat rating Important
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) aspnetcore-runtime-8.0-8.0.33-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.33-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.33-1.el9_4 +11
  • RHSA-2026:93455 Released 2026-11-02 · Red Hat rating Important
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.33-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.33-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.33-1.el10_0 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.el10_0
  • RHSA-2026:93065 Released 2026-10-30 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python3.12-brotli-1.2.1-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 python3.12-brotli-1.2.1-1.el9ap
  • RHSA-2026:92492 Released 2026-10-29 · Red Hat rating Important
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.33-1.el9_8, aspnetcore-runtime-dbg-8.0-8.0.33-1.el9_8, aspnetcore-targeting-pack-8.0-8.0.33-1.el9_8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.el9_8
  • RHSA-2026:92378 Released 2026-10-29 · Red Hat rating Important
    nodejs:24 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x::nodejs:24 +25
  • RHSA-2026:92861 Released 2026-10-29 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
  • RHSA-2026:92856 Released 2026-10-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9
  • RHSA-2026:92428 Released 2026-10-29 · Red Hat rating Important
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.33-1.el10_2, aspnetcore-runtime-dbg-8.0-8.0.33-1.el10_2, aspnetcore-targeting-pack-8.0-8.0.33-1.el10_2 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.el10_2
  • RHSA-2026:92420 Released 2026-10-29 · Red Hat rating Important
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.33-1.el8_10, aspnetcore-runtime-dbg-8.0-8.0.33-1.el8_10, aspnetcore-targeting-pack-8.0-8.0.33-1.el8_10 +9
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.el8_10
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:92376 Released 2026-10-29 · Red Hat rating Important
    nodejs:24 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 +25
  • RHSA-2026:91709 Released 2026-10-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.33-0.1.hum1@aarch64, aspnetcore-runtime-8.0-8.0.33-0.1.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.33-0.1.hum1@aarch64 +22
  • RHSA-2026:90890 Released 2026-10-27 · Red Hat rating Important
    brotli security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) brotli-1.0.9-7.el9_6.3, brotli-devel-1.0.9-7.el9_6.3, python3-brotli-1.0.9-7.el9_6.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) brotli-1.0.9-7.el9_6.3, libbrotli-1.0.9-7.el9_6.3
  • RHSA-2026:90914 Released 2026-10-27 · Red Hat rating Important
    brotli security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) brotli-1.0.9-6.el9_2.3, brotli-devel-1.0.9-6.el9_2.3, python3-brotli-1.0.9-6.el9_2.3
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) brotli-1.0.9-6.el9_2.3, libbrotli-1.0.9-6.el9_2.3
  • RHSA-2026:90892 Released 2026-10-27 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) brotli-devel-1.0.6-4.el8_4.1, python3-brotli-1.0.6-4.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) brotli-devel-1.0.6-4.el8_4.1, python3-brotli-1.0.6-4.el8_4.1
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) brotli-1.0.6-4.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) brotli-1.0.6-4.el8_4.1
  • RHSA-2026:90891 Released 2026-10-27 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) brotli-devel-1.0.6-4.el8_8.1, python3-brotli-1.0.6-4.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) brotli-devel-1.0.6-4.el8_8.1, python3-brotli-1.0.6-4.el8_8.1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) brotli-1.0.6-4.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) brotli-1.0.6-4.el8_8.1
  • RHSA-2026:90888 Released 2026-10-27 · Red Hat rating Important
    brotli security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) brotli-1.0.9-6.el9_4.3, brotli-devel-1.0.9-6.el9_4.3, python3-brotli-1.0.9-6.el9_4.3
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) brotli-1.0.9-6.el9_4.3, libbrotli-1.0.9-6.el9_4.3
  • RHSA-2026:90893 Released 2026-10-27 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) brotli-devel-1.0.6-4.el8_6.1, python3-brotli-1.0.6-4.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) brotli-devel-1.0.6-4.el8_6.1, python3-brotli-1.0.6-4.el8_6.1
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) brotli-1.0.6-4.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) brotli-1.0.6-4.el8_6.1
  • RHSA-2026:90889 Released 2026-10-27 · Red Hat rating Important
    brotli security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) brotli-1.1.0-6.el10_0.3, brotli-devel-1.1.0-6.el10_0.3, python3-brotli-1.1.0-6.el10_0.3
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) brotli-1.1.0-6.el10_0.3, libbrotli-1.1.0-6.el10_0.3
  • RHSA-2026:90501 Released 2026-10-26 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream (v. 8) brotli-devel-1.0.6-5.el8_10, python3-brotli-1.0.6-5.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) brotli-1.0.6-5.el8_10
  • RHSA-2026:90495 Released 2026-10-26 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream (v. 9) brotli-1.0.9-10.el9_8.1, brotli-devel-1.0.9-10.el9_8.1, python3-brotli-1.0.9-10.el9_8.1
    • Red Hat Enterprise Linux BaseOS (v. 9) brotli-1.0.9-10.el9_8.1, libbrotli-1.0.9-10.el9_8.1
  • RHSA-2026:90449 Released 2026-10-26 · Red Hat rating Important
    brotli security update
    • Red Hat Enterprise Linux AppStream (v. 10) brotli-1.1.0-8.el10_2.1, brotli-devel-1.1.0-8.el10_2.1, python3-brotli-1.1.0-8.el10_2.1
    • Red Hat Enterprise Linux BaseOS (v. 10) brotli-1.1.0-8.el10_2.1, libbrotli-1.1.0-8.el10_2.1
  • RHSA-2026:87420 Released 2026-10-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images brotli-1.2.1-0.1.hum1@aarch64, brotli-1.2.1-0.1.hum1@s390x, brotli-1.2.1-0.1.hum1@src +10
  • RHSA-2026:19704 Released 2026-05-20 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) firefox-140.10.0-2.el7_9
  • RHSA-2026:19655 Released 2026-05-20 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-140.10.0-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox-140.10.0-1.el8_4
  • RHSA-2026:19542 Released 2026-05-20 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-140.10.0-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-140.10.0-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-140.10.0-1.el8_6
  • RHSA-2026:19462 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-140.10.0-1.el9_6
  • RHSA-2026:19464 Released 2026-05-20 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox-140.10.0-1.el9_4, firefox-x11-140.10.0-1.el9_4
  • RHSA-2026:19466 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-140.10.0-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-140.10.0-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-140.10.0-1.el8_6
  • RHSA-2026:19469 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) thunderbird-140.10.0-1.el9_4
  • RHSA-2026:19467 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) thunderbird-140.10.0-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) thunderbird-140.10.0-1.el8_8
  • RHSA-2026:19468 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-140.10.0-1.el9_0
  • RHSA-2026:19463 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) thunderbird-140.10.0-1.el10_0
  • RHSA-2026:19465 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-140.10.0-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird-140.10.0-1.el8_4
  • RHSA-2026:19461 Released 2026-05-20 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird-140.10.0-1.el9_2
  • RHSA-2026:19131 Released 2026-05-19 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.10.0-1.el10_2
  • RHSA-2026:17688 Released 2026-05-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox-140.10.0-1.el9_6, firefox-x11-140.10.0-1.el9_6
  • RHSA-2026:17689 Released 2026-05-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox-140.10.0-1.el9_2, firefox-x11-140.10.0-1.el9_2
  • RHSA-2026:17687 Released 2026-05-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-140.10.0-1.el9_0
  • RHSA-2026:17690 Released 2026-05-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox-140.10.0-1.el10_0
  • RHSA-2026:17477 Released 2026-05-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox-140.10.0-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox-140.10.0-1.el8_8
  • RHSA-2026:15892 Released 2026-05-11 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-140.10.0-1.el9_7
  • RHSA-2026:13537 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-140.10.0-1.el8_10
  • RHSA-2026:10766 Released 2026-04-27 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-140.10.0-1.el8_10
  • RHSA-2026:10767 Released 2026-04-27 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 10) firefox-140.10.0-1.el10_1
  • RHSA-2026:10757 Released 2026-04-27 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-140.10.0-1.el9_7, firefox-x11-140.10.0-1.el9_7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Developer Hub 2AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Core ServicesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2026:93065
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2026:93065
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:94100
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:94100
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:92856
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:94101
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:94108
Red Hat Build of Apache Camel 3.33.4.SP2Fixed RHSA-2026:93980
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:93457
Red Hat Discovery 2Fixed RHSA-2026:94802
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:10767, RHSA-2026:19131, RHSA-2026:90449, RHSA-2026:92428
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:10766, RHSA-2026:13537, RHSA-2026:90501, RHSA-2026:92376, RHSA-2026:92420
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:10757, RHSA-2026:15892, RHSA-2026:90495, RHSA-2026:92378, RHSA-2026:92492
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:19465, RHSA-2026:19655, RHSA-2026:90892
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:19466, RHSA-2026:19542, RHSA-2026:90893
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:19466, RHSA-2026:19542
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:17477, RHSA-2026:19467, RHSA-2026:90891
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:17687, RHSA-2026:19468
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:17689, RHSA-2026:19461, RHSA-2026:90914
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:90888, RHSA-2026:93456
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:17690, RHSA-2026:19463, RHSA-2026:90889, RHSA-2026:93455
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:19464, RHSA-2026:19469
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:17688, RHSA-2026:19462, RHSA-2026:90890, RHSA-2026:93457
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:19465, RHSA-2026:19655, RHSA-2026:90892
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:90893
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:19466, RHSA-2026:19542
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:17477, RHSA-2026:19467, RHSA-2026:90891
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:90449
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:90501
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:90495
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:90892
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:90893
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:90891
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:90914
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:90888
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:90889
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:90890
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:90892
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:90893
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:90891
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:92420
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:92428
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:92492
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:93455
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:19704
Red Hat Hardened ImagesFixed RHSA-2026:87420, RHSA-2026:91709
Red Hat OpenShift AI 3.0Fixed RHSA-2026:94458, RHSA-2026:94459, RHSA-2026:94463, RHSA-2026:94466, RHSA-2026:94476
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510, RHSA-2026:93550, RHSA-2026:94452, RHSA-2026:94455, RHSA-2026:94457, RHSA-2026:94461, RHSA-2026:94464, RHSA-2026:94465, RHSA-2026:94468, RHSA-2026:94469, RHSA-2026:94472
Red Hat OpenShift AI 3.5Fixed RHSA-2026:94453, RHSA-2026:94454, RHSA-2026:94460, RHSA-2026:94462, RHSA-2026:94467, RHSA-2026:94470, RHSA-2026:94471, RHSA-2026:94473, RHSA-2026:94474
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:95346
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:93984, RHSA-2026:93987
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:95655
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:95655
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:95656
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:95657
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:92861
Red Hat build of Quarkus 3.27.6.SP2Fixed RHSA-2026:93908
Red Hat build of Quarkus 3.33.4.SP2Fixed RHSA-2026:93902
Not affected: 26 products
  • Confidential Compute Attestation
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Service Mesh 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Build of Apache Camel 3.33.4.SP2
  • Red Hat Build of Keycloak
  • Red Hat Connectivity Link 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift Update Service
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat Trusted Profile Analyzer
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-111497
  2. 2026-10-22 Alias added: GHSA-9v8h-qqgm-4m35
  3. 2026-10-22 CISA SSVC decision points changed
  4. 2026-10-22 Priority changed: MEDIUM → LOW
  5. 2026-10-23 Fix available: RHSA-2026:87420 · Red Hat
  6. 2026-10-23 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-10-23 CVSS score added · Red Hat
  8. 2026-10-23 Priority changed: LOW → MEDIUM
  9. 2026-10-23 CISA SSVC decision points changed
  10. 2026-10-23 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-9v8h-qqgm-4m35
  11. 2026-10-23 CVSS score added · GHSA-9v8h-qqgm-4m35
  12. 2026-10-23 Weakness changed · GHSA-9v8h-qqgm-4m35
  13. 2026-10-23 17 new references · GHSA-9v8h-qqgm-4m35
  14. 2026-10-23 Title updated · GHSA-9v8h-qqgm-4m35
  15. 2026-10-24 EPSS moved to the 50th–90th percentile
  16. 2026-10-24 Title updated · CNA
  17. 2026-10-24 CISA SSVC decision points changed
  18. 2026-10-25 EPSS moved to the 95th–99th percentile
  19. 2026-10-25 Priority changed: MEDIUM → HIGH
  20. 2026-10-26 Affected versions changed · Red Hat
  21. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +13 · Red Hat
  22. 2026-10-27 Added to CISA KEV
  23. 2026-10-27 EPSS moved to the 99th percentile and above
  24. 2026-10-27 Fix available: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
  25. 2026-10-27 1 new reference · CNA
  26. 2026-10-27 Affected versions changed · Red Hat
  27. 2026-10-27 CISA SSVC decision points changed
  28. 2026-10-27 CISA SSVC decision points changed
  29. 2026-10-27 Priority changed: HIGH → CRITICAL
  30. 2026-10-27 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.4) +5 · Red Hat
  31. 2026-10-28 CISA SSVC decision points changed
  32. 2026-10-28 Fix available: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v.9.6) +1 · Red Hat
  33. 2026-10-28 CVSS score added · NVD
  34. 2026-10-29 Fix available: RHSA-2026:10757 · Red Hat
  35. 2026-10-29 Fix available: RHSA-2026:10766 · Red Hat
  36. 2026-10-29 Fix available: RHSA-2026:15892 · Red Hat
  37. 2026-10-29 Fix available: RHSA-2026:13537 · Red Hat
  38. 2026-10-29 Fix available: RHSA-2026:10767 · Red Hat
  39. 2026-10-29 Fix available: RHSA-2026:17688 · Red Hat
  40. 2026-10-29 Fix available: RHSA-2026:17689 · Red Hat
  41. 2026-10-29 Fix available: RHSA-2026:17477 · Red Hat
  42. 2026-10-29 Fix available: RHSA-2026:17687 · Red Hat
  43. 2026-10-29 Fix available: RHSA-2026:19131 · Red Hat
  44. 2026-10-29 Fix available: RHSA-2026:17690 · Red Hat
  45. 2026-10-29 Fix available: RHSA-2026:19461 · Red Hat
  46. 2026-10-29 Fix available: RHSA-2026:19467 · Red Hat
  47. 2026-10-29 Fix available: RHSA-2026:19466 · Red Hat
  48. 2026-10-29 Fix available: RHSA-2026:19465 · Red Hat
  49. 2026-10-29 Fix available: RHSA-2026:19464 · Red Hat
  50. 2026-10-29 Fix available: RHSA-2026:19463 · Red Hat
  51. 2026-10-29 Fix available: RHSA-2026:19462 · Red Hat
  52. 2026-10-29 Fix available: RHSA-2026:19468 · Red Hat
  53. 2026-10-29 Fix available: RHSA-2026:19542 · Red Hat
  54. 2026-10-29 Fix available: RHSA-2026:19655 · Red Hat
  55. 2026-10-29 Fix available: RHSA-2026:90495 · Red Hat
  56. 2026-10-29 Fix available: RHSA-2026:90449 · Red Hat
  57. 2026-10-29 Fix available: RHSA-2026:19704 · Red Hat
  58. 2026-10-29 Fix available: RHSA-2026:90888 · Red Hat
  59. 2026-10-29 Fix available: RHSA-2026:90892 · Red Hat
  60. 2026-10-29 Fix available: RHSA-2026:90890 · Red Hat
  61. 2026-10-29 Fix available: RHSA-2026:90914 · Red Hat
  62. 2026-10-29 Fix available: RHSA-2026:90893 · Red Hat
  63. 2026-10-29 Fix available: RHSA-2026:90891 · Red Hat
  64. 2026-10-29 Fix available: RHSA-2026:90889 · Red Hat
  65. 2026-10-29 Fix available: RHSA-2026:90501 · Red Hat
  66. 2026-10-29 Fix available: RHSA-2026:19469 · Red Hat
  67. 2026-10-29 14 new references · GHSA-9v8h-qqgm-4m35
  68. 2026-10-29 Affected versions changed · Red Hat
  69. 2026-10-30 Fix available: RHSA-2026:91709 · Red Hat
  70. 2026-10-30 Fix available: RHSA-2026:92378 · Red Hat
  71. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  72. 2026-10-30 Fix available: RHSA-2026:92376 · Red Hat
  73. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  74. 2026-10-30 Fix available: RHSA-2026:92428 · Red Hat
  75. 2026-10-30 Fix available: RHSA-2026:92492 · Red Hat
  76. 2026-10-30 Fix available: RHSA-2026:92420 · Red Hat
  77. 2026-10-30 Fix available: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Enterprise Linux CRB (v. 8) +3 · Red Hat
  78. 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
  79. 2026-10-31 Fix available: RHSA-2026:93065 · Red Hat
  80. 2026-10-31 Affected versions changed · Red Hat
  81. 2026-11-02 Fix available: RHSA-2026:93455 · Red Hat
  82. 2026-11-02 Fix available: RHSA-2026:93457 · Red Hat
  83. 2026-11-02 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · Red Hat
  84. 2026-11-02 Fix available: RHSA-2026:93456 · Red Hat
  85. 2026-11-02 Fix available: RHSA-2026:93550 · Red Hat
  86. 2026-11-02 Affected versions changed · Red Hat
  87. 2026-11-02 Fix available: Red Hat build of Quarkus 3.27.6.SP2, Red Hat build of Quarkus 3.33.4.SP2 · Red Hat
  88. 2026-11-03 Fix available: RHSA-2026:93902 · Red Hat
  89. 2026-11-03 Fix available: RHSA-2026:94100 · Red Hat
  90. 2026-11-03 Fix available: RHSA-2026:94101 · Red Hat
  91. 2026-11-03 Fix available: RHSA-2026:93908 · Red Hat
  92. 2026-11-03 Fix available: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9 +1 · Red Hat
  93. 2026-11-03 Fix available: RHSA-2026:93980 · Red Hat
  94. 2026-11-03 Fix available: RHSA-2026:93987 · Red Hat
  95. 2026-11-03 Fix available: RHSA-2026:93984 · Red Hat
  96. 2026-11-03 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  97. 2026-11-03 Fix available: RHSA-2026:94108 · Red Hat
  98. 2026-11-03 Fix available: RHSA-2026:94453 · Red Hat
  99. 2026-11-03 Fix available: RHSA-2026:94452 · Red Hat
  100. 2026-11-03 Fix available: RHSA-2026:94454 · Red Hat
  101. 2026-11-03 Fix available: RHSA-2026:94455 · Red Hat
  102. 2026-11-03 Fix available: RHSA-2026:94457 · Red Hat
  103. 2026-11-03 Fix available: RHSA-2026:94458 · Red Hat
  104. 2026-11-03 Fix available: RHSA-2026:94459 · Red Hat
  105. 2026-11-03 Fix available: RHSA-2026:94462 · Red Hat
  106. 2026-11-03 Fix available: RHSA-2026:94463 · Red Hat
  107. 2026-11-03 Fix available: RHSA-2026:94466 · Red Hat
  108. 2026-11-03 Fix available: RHSA-2026:94464 · Red Hat
  109. 2026-11-03 Fix available: RHSA-2026:94468 · Red Hat
  110. 2026-11-03 Fix available: RHSA-2026:94465 · Red Hat
  111. 2026-11-03 Fix available: RHSA-2026:94469 · Red Hat
  112. 2026-11-03 Fix available: RHSA-2026:94461 · Red Hat
  113. 2026-11-03 Fix available: RHSA-2026:94460 · Red Hat
  114. 2026-11-03 Fix available: Red Hat Ansible Automation Platform 2.7, Red Hat OpenShift AI 3.0, Red Hat OpenShift AI 3.5 · Red Hat
  115. 2026-11-03 CVSS score changed · GHSA-9v8h-qqgm-4m35
  116. 2026-11-03 3 new references · GHSA-9v8h-qqgm-4m35
  117. 2026-11-04 Fix available: RHSA-2026:94474 · Red Hat
  118. 2026-11-04 Fix available: RHSA-2026:94472 · Red Hat
  119. 2026-11-04 Fix available: RHSA-2026:94467 · Red Hat
  120. 2026-11-04 Fix available: RHSA-2026:94476 · Red Hat
  121. 2026-11-04 Fix available: RHSA-2026:94470 · Red Hat
  122. 2026-11-04 Fix available: RHSA-2026:94473 · Red Hat
  123. 2026-11-04 Fix available: RHSA-2026:94471 · Red Hat
  124. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  125. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
  126. 2026-11-05 Fix available: Red Hat Ansible Automation Platform 2.6 · Red Hat
  127. 2026-11-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
  128. 2026-11-06 Fix available: RHSA-2026:92856 · Red Hat
  129. 2026-11-06 Fix available: RHSA-2026:95656 · Red Hat
  130. 2026-11-06 Fix available: RHSA-2026:95655 · Red Hat
  131. 2026-11-06 Fix available: RHSA-2026:95657 · Red Hat
  132. 2026-11-07 Fix available: RHSA-2026:95346 · Red Hat
  133. 2026-11-07 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat

References

Patch 1

Advisory 18

Other 17

  • TI-2020-07165 Buffer overflow in Brotli library CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences