{"id":"CVE-2026-111497","aliases":["ALPINE-CVE-2026-111497","ALSA-2026:10766","ALSA-2026:13537","ALSA-2026:90449","ALSA-2026:90495","ALSA-2026:90501","ALSA-2026:92376","ALSA-2026:92378","ALSA-2026:92420","ALSA-2026:92428","ALSA-2026:92492","AZL-110384","AZL-111005","AZL-111041","AZL-111518","AZL-112175","BELL-CVE-2026-111497","BIT-brotli-2026-111497","BIT-dotnet-2026-111497","BIT-dotnet-sdk-2026-111497","BIT-node-2026-111497","BIT-node-min-2026-111497","BIT-powershell-2026-111497","CLSA-2026-1792754583","CLSA-2026-1792755607","CLSA-2026-1792824525","CLSA-2026-1792824700","CLSA-2026-1792824879","CLSA-2026-1792827041","CLSA-2026-1792827285","CLSA-2026-1792827522","CLSA-2026-1792832424","CLSA-2026-1792865919","CLSA-2026-1792867484","DEBIAN-CVE-2026-111497","EEF-CVE-2026-111497","EUVD-2026-108169","GHSA-9v8h-qqgm-4m35","GHSA-c9gr-gmg4-2vqv","GO-2026-6888","OESA-2026-4539","OESA-2026-4540","OESA-2026-4541","OESA-2026-4542","OESA-2026-4601","OESA-2026-4602","OESA-2026-4603","PYSEC-2026-4322","PYSEC-2026-4323","RLSA-2026:90449","RLSA-2026:90495","RLSA-2026:90501","RLSA-2026:92376","RLSA-2026:92378","RLSA-2026:92420","RLSA-2026:92428","RLSA-2026:92492","RLSA-2026:98522","ROOT-APP-PYPI-GHSA-9v8h-qqgm-4m35","ROOT-OS-ALPINE-315-CVE-2026-111497","ROOT-OS-ALPINE-320-CVE-2026-111497","ROOT-OS-DEBIAN-11-CVE-2026-111497","ROOT-OS-UBUNTU-2004-CVE-2026-111497","ROOT-OS-UBUNTU-2204-CVE-2026-111497","ROOT-OS-UBUNTU-2404-CVE-2026-111497","ROOT-OS-UBUNTU-2504-CVE-2026-111497","ROOT-OS-UBUNTU-2510-CVE-2026-111497","ROOT-OS-UBUNTU-2604-CVE-2026-111497","SUSE-SU-2026:24476-1","SUSE-SU-2026:24518-1","SUSE-SU-2026:24556-1","SUSE-SU-2026:24597-1","SUSE-SU-2026:24600-1","SUSE-SU-2026:24601-1","SUSE-SU-2026:4928-1","SUSE-SU-2026:4945-1","SUSE-SU-2026:4957-1","SUSE-SU-2026:5036-1","SUSE-SU-2026:5037-1","SUSE-SU-2026:5125-1","SUSE-SU-2026:5145-1","UBUNTU-CVE-2026-111497","USN-8956-1","USN-8956-2","USN-8958-1","openSUSE-SU-2026:12232-1","openSUSE-SU-2026:12248-1","openSUSE-SU-2026:12305-1","openSUSE-SU-2026:12322-1","openSUSE-SU-2026:12353-1","openSUSE-SU-2026:12439-1","openSUSE-SU-2026:12505-1","openSUSE-SU-2026:22183-1","openSUSE-SU-2026:22210-1","openSUSE-SU-2026:22213-1"],"status":"published","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.82641,"percentile":0.99672,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-252","CWE-787"],"published":"2026-04-27T00:00:00Z","modified":"2026-11-12T00:30:03Z","kev":{"date_added":"2026-10-27","due_date":"2026-11-10","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-10-27"},{"source":"kev","since":"2026-10-27"}],"exploits":[{"source":"pocgithub","id":"CaterMaoZi/CVE-2026-111497-POC","title":"CaterMaoZi/CVE-2026-111497-POC","date":"2026-10-21","url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC"},{"source":"pocgithub","id":"AdapptOnAzure/cve-2026-111497-mitigation","title":"AdapptOnAzure/cve-2026-111497-mitigation","date":"2026-10-22","url":"https://github.com/AdapptOnAzure/cve-2026-111497-mitigation"},{"source":"pocgithub","id":"Sami-AlEsh/nodejs-security-check","title":"Sami-AlEsh/nodejs-security-check","date":"2026-10-22","url":"https://github.com/Sami-AlEsh/nodejs-security-check"},{"source":"pocgithub","id":"TahuCryptsi/node-brotli-check","title":"TahuCryptsi/node-brotli-check","date":"2026-10-22","url":"https://github.com/TahuCryptsi/node-brotli-check"},{"source":"pocgithub","id":"TheFool-TAROT/CVE-2026-111497-brotli-pwn","title":"TheFool-TAROT/CVE-2026-111497-brotli-pwn","date":"2026-10-22","url":"https://github.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn"},{"source":"pocgithub","id":"dimasma0305/CVE-2026-111497-POC","title":"dimasma0305/CVE-2026-111497-POC","date":"2026-10-22","url":"https://github.com/dimasma0305/CVE-2026-111497-POC"},{"source":"pocgithub","id":"hypnguyen1209/CVE-2026-111497","title":"hypnguyen1209/CVE-2026-111497","date":"2026-10-22","url":"https://github.com/hypnguyen1209/CVE-2026-111497"},{"source":"pocgithub","id":"ikow/brotli2crash","title":"ikow/brotli2crash","date":"2026-10-22","url":"https://github.com/ikow/brotli2crash"},{"source":"pocgithub","id":"incu-tech/october-cyber-family","title":"incu-tech/october-cyber-family","date":"2026-10-22","url":"https://github.com/incu-tech/october-cyber-family"},{"source":"pocgithub","id":"AmanSin001/node-brotli-check","title":"AmanSin001/node-brotli-check","date":"2026-10-23","url":"https://github.com/AmanSin001/node-brotli-check"},{"source":"pocgithub","id":"Arkango/CVE-2026-111497","title":"Arkango/CVE-2026-111497","date":"2026-10-23","url":"https://github.com/Arkango/CVE-2026-111497"},{"source":"pocgithub","id":"Charlie-Netdevops/node-hostcheck","title":"Charlie-Netdevops/node-hostcheck","date":"2026-10-23","url":"https://github.com/Charlie-Netdevops/node-hostcheck"},{"source":"pocgithub","id":"CompleteTech-Security/node2shell-check","title":"CompleteTech-Security/node2shell-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/node2shell-check"},{"source":"pocgithub","id":"Ghost-Bx1/Node2Shell-CVE-2026-111497","title":"Ghost-Bx1/Node2Shell-CVE-2026-111497","date":"2026-10-23","url":"https://github.com/Ghost-Bx1/Node2Shell-CVE-2026-111497"},{"source":"pocgithub","id":"TahuCryptsi/brotli-distro-check","title":"TahuCryptsi/brotli-distro-check","date":"2026-10-23","url":"https://github.com/TahuCryptsi/brotli-distro-check"},{"source":"pocgithub","id":"ZeroHackOrg/node2shell-poc","title":"ZeroHackOrg/node2shell-poc","date":"2026-10-23","url":"https://github.com/ZeroHackOrg/node2shell-poc"},{"source":"pocgithub","id":"datmt/vulcheck","title":"datmt/vulcheck","date":"2026-10-23","url":"https://github.com/datmt/vulcheck"},{"source":"pocgithub","id":"duytien241/nodejs-CVE-2026-111497","title":"duytien241/nodejs-CVE-2026-111497","date":"2026-10-23","url":"https://github.com/duytien241/nodejs-CVE-2026-111497"},{"source":"pocgithub","id":"fuzheado/n2s-buildpack-probe","title":"fuzheado/n2s-buildpack-probe","date":"2026-10-23","url":"https://github.com/fuzheado/n2s-buildpack-probe"},{"source":"pocgithub","id":"shivrajem/node2shell-detect","title":"shivrajem/node2shell-detect","date":"2026-10-23","url":"https://github.com/shivrajem/node2shell-detect"},{"source":"pocgithub","id":"trailofbits/brotli-checker","title":"trailofbits/brotli-checker","date":"2026-10-23","url":"https://github.com/trailofbits/brotli-checker"},{"source":"pocgithub","id":"w116tjb/CVE-2026-111497_nodejs_hash_lookup","title":"w116tjb/CVE-2026-111497_nodejs_hash_lookup","date":"2026-10-23","url":"https://github.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup"},{"source":"pocgithub","id":"Blackman99/lotstamp","title":"Blackman99/lotstamp","date":"2026-10-24","url":"https://github.com/Blackman99/lotstamp"},{"source":"pocgithub","id":"Secragon/node2shell-radar","title":"Secragon/node2shell-radar","date":"2026-10-24","url":"https://github.com/Secragon/node2shell-radar"},{"source":"pocgithub","id":"bastet-ai/brotli-firing-range","title":"bastet-ai/brotli-firing-range","date":"2026-10-24","url":"https://github.com/bastet-ai/brotli-firing-range"}],"exploits_more":63,"fixes":[{"ecosystem":"PyPI","package":"brotli","fixed_in":["1.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"brotlicffi","fixed_in":["1.2.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.21","package":"brotli","fixed_in":["1.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"brotli","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"brotli","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"brotli","fixed_in":["1.1.0-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"brotli-devel","fixed_in":["1.1.0-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libbrotli","fixed_in":["1.1.0-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"python3-brotli","fixed_in":["1.1.0-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"brotli","fixed_in":["1.0.9-10.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"brotli-devel","fixed_in":["1.0.9-10.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libbrotli","fixed_in":["1.0.9-10.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-brotli","fixed_in":["1.0.9-10.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"brotli","fixed_in":["1.0.6-5.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"brotli-devel","fixed_in":["1.0.6-5.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-brotli","fixed_in":["1.0.6-5.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"brotli","fixed_in":["1.2.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.22.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"brotli","fixed_in":["1.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"brotli","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dotnet8-runtime","fixed_in":["8.0.33-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"brotli","fixed_in":["1.1.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"brotli","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"brotli","fixed_in":["1.0.10","1.1.1","1.2.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["8.0.33","9.0.22","10.0.14"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["8.0.33","9.0.22","10.0.14"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"powershell","fixed_in":["7.4.22","7.5.13","7.6.9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"brotli","fixed_in":["1.0.9-7.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"brotli-devel","fixed_in":["1.0.9-7.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbrotli","fixed_in":["1.0.9-7.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-brotli","fixed_in":["1.0.9-7.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"brotli","fixed_in":["1.0.9-7.el9_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"brotli-devel","fixed_in":["1.0.9-7.el9_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libbrotli","fixed_in":["1.0.9-7.el9_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-brotli","fixed_in":["1.0.9-7.el9_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"brotli","fixed_in":["1.0.3-1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbrotli-dev","fixed_in":["1.0.3-1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbrotli1","fixed_in":["1.0.3-1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"python-brotli","fixed_in":["1.0.3-1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"python3-brotli","fixed_in":["1.0.3-1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"brotli","fixed_in":["1.0.7-6ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libbrotli-dev","fixed_in":["1.0.7-6ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libbrotli1","fixed_in":["1.0.7-6ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"python3-brotli","fixed_in":["1.0.7-6ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"brotli","fixed_in":["1.0.3-1ubuntu1~16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libbrotli-dev","fixed_in":["1.0.3-1ubuntu1~16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libbrotli1","fixed_in":["1.0.3-1ubuntu1~16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"python-brotli","fixed_in":["1.0.3-1ubuntu1~16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"python3-brotli","fixed_in":["1.0.3-1ubuntu1~16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"brotli-devel","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"brotli-devel","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"brotli-devel","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-brotli","fixed_in":["1.0.6-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"brotli","fixed_in":["1.0.7-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libbrotli-dev","fixed_in":["1.0.7-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libbrotli1","fixed_in":["1.0.7-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"python-brotli","fixed_in":["1.0.7-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"python3-brotli","fixed_in":["1.0.7-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"brotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"brotli-devel","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libbrotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"python3-brotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"brotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"brotli-devel","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libbrotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"python3-brotli","fixed_in":["1.0.9-10.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"brotli","fixed_in":["1.0.9-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"brotli","fixed_in":["1.1.0-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"brotli","fixed_in":["1.2.0-4.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2026.08+ds-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["24.22.1+dfsg+~cs24.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-brotlicffi","fixed_in":["1.2.1.0+ds-1"],"sources":["osv"]},{"ecosystem":"Hex","package":"brotli","fixed_in":["0.3.4"],"sources":["osv"]},{"ecosystem":"Go","package":"github.com/andybalholm/brotli","fixed_in":["1.2.7"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"brotli","fixed_in":["1.1.1-1.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"brotli","fixed_in":["1.0.10-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"brotli","fixed_in":["1.1.1-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"brotli","fixed_in":["1.1.1-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-brotlicffi","fixed_in":["1.1.0.0-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-brotlicffi","fixed_in":["1.1.0.0-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python-brotlicffi","fixed_in":["1.1.0.0-2.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"brotli","fixed_in":["0:1.1.0-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"brotli","fixed_in":["0:1.0.9-10.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"brotli","fixed_in":["0:1.0.6-5.el8_10"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"brotli","fixed_in":["1.2.0+aikido.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"brotlicffi","fixed_in":["1.2.0.0+aikido.1","1.2.0.0+aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"brotli","fixed_in":["1.0.9-r50071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-brotli","fixed_in":["1.0.9-r50071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"brotli","fixed_in":["1.1.0-r20071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-brotli","fixed_in":["1.1.0-r20071"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"brotli","fixed_in":["1.0.9-2.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-brotli","fixed_in":["1.0.9-2.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:20.04","package":"brotli","fixed_in":["1.0.7-6ubuntu0.1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:20.04","package":"rootio-brotli","fixed_in":["1.0.7-6ubuntu0.1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:25.04","package":"brotli","fixed_in":["1.1.0-2build4.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:25.04","package":"rootio-brotli","fixed_in":["1.1.0-2build4.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:25.10","package":"brotli","fixed_in":["1.1.0-2build5.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:25.10","package":"rootio-brotli","fixed_in":["1.1.0-2build5.aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"brotli","fixed_in":["1.1.0-159998.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"brotli","fixed_in":["1.1.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"brotli","fixed_in":["1.1.0-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"brotli","fixed_in":["1.1.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"brotli","fixed_in":["1.1.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"brotli","fixed_in":["1.0.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-Brotli","fixed_in":["1.1.0-150400.7.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"brotli","fixed_in":["1.0.3-1ubuntu1~16.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"brotli","fixed_in":["1.0.3-1ubuntu1.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"brotli","fixed_in":["1.0.7-6ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"brotli","fixed_in":["1.0.9-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","fixed_in":["8.0.133-8.0.33-0ubuntu1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"brotli","fixed_in":["1.1.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dotnet10","fixed_in":["10.0.114-10.0.14-0ubuntu1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","fixed_in":["8.0.133-8.0.33-0ubuntu1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"brotli","fixed_in":["1.2.0-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"dotnet10","fixed_in":["10.0.114-10.0.14-0ubuntu1~26.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"dotnet11","fixed_in":["11.0.100-11.0.0~rc3-0ubuntu1~26.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"brotli","fixed_in":["1.2.0-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"dotnet10","fixed_in":["10.0.114-10.0.14-0ubuntu1~26.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"brotli","fixed_in":["1.2.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Brotli","fixed_in":["1.2.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","fixed_in":["10.08.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trufflehog","fixed_in":["3.99.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","fixed_in":["26.11.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"brotli","fixed_in":["1.1.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.0-1.el8_10.alma.1"}]}],"bundled":26},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.0-1.el8_10.alma.1"}]}],"bundled":26},{"source":"osv","ecosystem":"AlmaLinux:10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.8.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"16.02-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.0-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-r2"},{"fixed":"1.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9-r10"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.11-r1"},{"fixed":"8.0.33-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-r2"},{"fixed":"1.1.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9-r10"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"brotli","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.3"},{"fixed":"1.0.10"},{"introduced":"1.1.0"},{"fixed":"1.1.1"},{"introduced":"1.2.0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.33"},{"introduced":"9.0.0"},{"fixed":"9.0.22"},{"introduced":"10.0.0"},{"fixed":"10.0.14"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.33"},{"introduced":"9.0.0"},{"fixed":"9.0.22"},{"introduced":"10.0.0"},{"fixed":"10.0.14"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"26.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"26.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"powershell","ranges":[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.22"},{"introduced":"7.5.0"},{"fixed":"7.5.13"},{"introduced":"7.6.0"},{"fixed":"7.6.9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-7.el9_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbrotli-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbrotli1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libbrotli-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libbrotli1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libbrotli-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libbrotli1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libbrotli-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libbrotli1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"python-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libbrotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-10.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-2+deb12u1"}]}],"versions":["1.0.9-2"]},{"source":"osv","ecosystem":"Debian:13","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2+deb13u1"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-4.1"}]}],"versions":["1.1.0-2","1.2.0-1","1.2.0-2","1.2.0-3","1.2.0-4"]},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.11-6","2022.11-6+deb12u1","2022.11-6+deb12u2","2023.02-1","2023.02-2","2023.05-1","2023.05-2","2023.08-1","2023.11-1","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-7","2023.11-8","2024.02-1","2024.02-2","2024.05-1","2024.05-2","2024.08-1","2024.08-2","2024.08-3","2024.08-4","2024.11-1","2024.11-2","2024.11-3","2024.11-4","2024.11-5","2025.02-1","2025.02-10","2025.02-2","2025.02-3","2025.02-4","2025.02-5","2025.02-6","2025.02-7","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2","2026.08+ds-3"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-10","2025.02-8","2025.02-8+deb13u1","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2","2026.08+ds-3"]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.08+ds-3"}]}],"versions":["2025.02-10","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2"]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1","18.20.4+dfsg-1~deb12u2","18.20.4+dfsg-1~deb12u3","20.10.0+dfsg-1","20.12.2+dfsg-1","20.13.0+dfsg-1","20.13.1+dfsg-1","20.13.1+dfsg-2","20.14.0+dfsg-1","20.14.0+dfsg-2","20.14.0+dfsg-3","20.15.0+dfsg-1","20.15.1+dfsg-1","20.16.0+dfsg-1","20.17.0+dfsg-1","20.17.0+dfsg-2","20.18.0+dfsg-1","20.18.0+dfsg-2","20.18.1+dfsg-1","20.18.1+dfsg-2","20.18.2+dfsg-1","20.18.2+dfsg-2","20.18.2+dfsg-3","20.18.2+dfsg-4","20.18.3+dfsg-1","20.19.0+dfsg-1","20.19.0+dfsg-2","20.19.0+dfsg1-1","20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1","20.19.2+dfsg-1+deb13u2","20.19.2+dfsg-1+deb13u3","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1+dfsg+~cs24.19.2-1"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0.0+ds1-1","1.1.0.0+ds1-2","1.2.0.0+ds-1","1.2.0.0+ds-2","1.2.0.1+ds-1","1.2.0.1+ds1-1","1.2.0.1+ds1-2","1.2.0.1+ds1-3","1.2.0.1+ds1-4","1.2.0.1+ds1-5","1.2.0.1+ds1-6","1.2.0.2+ds-1","1.2.1.0+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1.0+ds-1"}]}],"versions":["1.1.0.0+ds1-1","1.1.0.0+ds1-2","1.2.0.0+ds-1","1.2.0.0+ds-2","1.2.0.1+ds-1","1.2.0.1+ds1-1","1.2.0.1+ds1-2","1.2.0.1+ds1-3","1.2.0.1+ds1-4","1.2.0.1+ds1-5","1.2.0.1+ds1-6","1.2.0.2+ds-1"]},{"source":"osv","ecosystem":"Hex","package":"brotli","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.4"}]}],"versions":["0.3.0","0.3.1","0.3.2","0.3.3"]},{"source":"osv","ecosystem":"PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1"}]}],"versions":["1.0.4","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1.0"}]}],"versions":["1.0.9.0","1.0.9.1","1.0.9.2","1.1.0.0","1.2.0.0","1.2.0.1","1.2.0.2"]},{"source":"osv","ecosystem":"Go","package":"github.com/andybalholm/brotli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0.0-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0.0-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0.0-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["0.5.2","0.6.0","1.0.1","1.0.4","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1.0"}]}],"versions":["0.8.0","1.0.9.0","1.0.9.1","1.0.9.2","1.1.0.0","1.2.0.0","1.2.0.1","1.2.0.2"]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-5.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.133-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.133-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.133-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40280+057606e8"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0+aikido.1"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.0+aikido.1"},{"fixed":"1.2.0.0+aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-r50071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-r50071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-r20071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-r20071"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-2.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-2.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:20.04","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:20.04","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:25.04","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2build4.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:25.04","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2build4.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:25.10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2build5.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:25.10","package":"rootio-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2build5.aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159998.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-118.19.2"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-118.19.2"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150700.3.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-150700.15.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150400.7.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-150400.157.19.1"}]}],"bundled":147},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+esm1"}]}],"versions":["0.2.0+dfsg-1","0.3.0+dfsg-1","0.3.0+dfsg-2","0.3.0+dfsg-2ubuntu1","1.0.3-1ubuntu1~16.04.1","1.0.3-1ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+esm1"}]}],"versions":["0.6.0-1build1","1.0.2-2","1.0.2-3","1.0.3-1ubuntu1","1.0.3-1ubuntu1.2","1.0.3-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+esm1"}]}],"versions":["1.0.7-2","1.0.7-2build1","1.0.7-4","1.0.7-5","1.0.7-6","1.0.7-6build1","1.0.7-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-2ubuntu0.1"}]}],"versions":["1.0.9-2build3","1.0.9-2build4","1.0.9-2build5","1.0.9-2build6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.108-0ubuntu1~22.04.1","6.0.109-0ubuntu1~22.04.1","6.0.110-0ubuntu1~22.04.1","6.0.111-0ubuntu1~22.04.1","6.0.113-0ubuntu1~22.04.1","6.0.116-0ubuntu1~22.04.1","6.0.118-0ubuntu1~22.04.1","6.0.119-0ubuntu1~22.04.1","6.0.120-0ubuntu1~22.04.1","6.0.121-0ubuntu1~22.04.1","6.0.122-0ubuntu1~22.04.1","6.0.123-0ubuntu1~22.04.1","6.0.124-0ubuntu1~22.04.1","6.0.125-0ubuntu1~22.04.1","6.0.126-0ubuntu1~22.04.1","6.0.127-0ubuntu1~22.04.1","6.0.128-0ubuntu1~22.04.2","6.0.132-0ubuntu1~22.04.1","6.0.133-0ubuntu1~22.04.1","6.0.135-0ubuntu1~22.04.1","6.0.136-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.105-0ubuntu1~22.04.1","7.0.107-0ubuntu1~22.04.1","7.0.108-0ubuntu1~22.04.1","7.0.109-0ubuntu1~22.04.1","7.0.110-0ubuntu1~22.04.1","7.0.111-0ubuntu1~22.04.1","7.0.112-0ubuntu1~22.04.1","7.0.113-0ubuntu1~22.04.1","7.0.114-0ubuntu1~22.04.1","7.0.115-0ubuntu1~22.04.1","7.0.116-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.2","7.0.119-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-8.0.33-0ubuntu1~22.04.1"}]}],"versions":["8.0.102-8.0.2-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.2","8.0.105-8.0.5-0ubuntu1~22.04.1","8.0.107-8.0.7-0ubuntu1~22.04.1","8.0.108-8.0.8-0ubuntu1~22.04.1","8.0.110-8.0.10-0ubuntu1~22.04.1","8.0.111-8.0.11-0ubuntu1~22.04.1","8.0.112-8.0.12-0ubuntu1~22.04.1","8.0.114-8.0.14-0ubuntu1~22.04.1","8.0.115-8.0.15-0ubuntu1~22.04.1","8.0.116-8.0.16-0ubuntu1~22.04.1","8.0.117-8.0.17-0ubuntu1~22.04.1","8.0.118-8.0.18-0ubuntu1~22.04.1","8.0.119-8.0.19-0ubuntu1~22.04.1","8.0.120-8.0.20-0ubuntu1~22.04.1","8.0.121-8.0.21-0ubuntu1~22.04.1","8.0.122-8.0.22-0ubuntu1~22.04.1","8.0.123-8.0.23-0ubuntu1~22.04.1","8.0.124-8.0.24-0ubuntu1~22.04.1","8.0.125-8.0.25-0ubuntu1~22.04.1","8.0.126-8.0.26-0ubuntu1~22.04.1","8.0.127-8.0.27-0ubuntu1~22.04.1","8.0.128-8.0.28-0ubuntu1~22.04.1","8.0.129-8.0.29-0ubuntu1~22.04.1","8.0.130-8.0.30-0ubuntu1~22.04.1","8.0.131-8.0.31-0ubuntu1~22.04.1","8.0.132-8.0.32-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1"}]}],"versions":["1.0.9-2build8","1.1.0-1","1.1.0-2~build1","1.1.0-2","1.1.0-2build1","1.1.0-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~24.04.1"}]}],"versions":["10.0.100-10.0.0-0ubuntu1~24.04.1","10.0.101-10.0.1-0ubuntu1~24.04.2","10.0.103-10.0.3-0ubuntu1~24.04.1","10.0.104-10.0.4-0ubuntu1~24.04.1","10.0.105-10.0.5-0ubuntu1~24.04.1","10.0.106-10.0.6-0ubuntu1~24.04.1","10.0.107-10.0.7-0ubuntu1~24.04.1","10.0.108-10.0.8-0ubuntu1~24.04.1","10.0.109-10.0.9-0ubuntu1~24.04.1","10.0.110-10.0.10-0ubuntu1~24.04.1","10.0.111-10.0.11-0ubuntu1~24.04.1","10.0.112-10.0.12-0ubuntu1~24.04.1","10.0.113-10.0.13-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-8.0.33-0ubuntu1~24.04.1"}]}],"versions":["8.0.100-8.0.0~rc1-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu2","8.0.100-8.0.0-0ubuntu1","8.0.100-8.0.0-0ubuntu2","8.0.101-8.0.1-0ubuntu1","8.0.101-8.0.1-0ubuntu2","8.0.102-8.0.2-0ubuntu1","8.0.103-8.0.3-0ubuntu2","8.0.103-8.0.3-0ubuntu3","8.0.104-8.0.4-0ubuntu1","8.0.105-8.0.5-0ubuntu1~24.04.1","8.0.107-8.0.7-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.2","8.0.110-8.0.10-0ubuntu1~24.04.1","8.0.111-8.0.11-0ubuntu1~24.04.1","8.0.112-8.0.12-0ubuntu1~24.04.1","8.0.114-8.0.14-0ubuntu1~24.04.1","8.0.115-8.0.15-0ubuntu1~24.04.1","8.0.116-8.0.16-0ubuntu1~24.04.1","8.0.117-8.0.17-0ubuntu1~24.04.1","8.0.118-8.0.18-0ubuntu1~24.04.1","8.0.119-8.0.19-0ubuntu1~24.04.1","8.0.120-8.0.20-0ubuntu1~24.04.1","8.0.121-8.0.21-0ubuntu1~24.04.1","8.0.122-8.0.22-0ubuntu1~24.04.1","8.0.123-8.0.23-0ubuntu1~24.04.1","8.0.124-8.0.24-0ubuntu1~24.04.1","8.0.125-8.0.25-0ubuntu1~24.04.1","8.0.126-8.0.26-0ubuntu1~24.04.1","8.0.127-8.0.27-0ubuntu1~24.04.1","8.0.128-8.0.28-0ubuntu1~24.04.1","8.0.129-8.0.29-0ubuntu1~24.04.1","8.0.130-8.0.30-0ubuntu1~24.04.1","8.0.131-8.0.31-0ubuntu1~24.04.1","8.0.132-8.0.32-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-4ubuntu0.1"}]}],"versions":["1.2.0-3build1","1.2.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~26.10.1"}]}],"versions":["10.0.105-10.0.5-0ubuntu1","10.0.107-10.0.7-0ubuntu1~26.04.1","10.0.108-10.0.8-0ubuntu1","10.0.109-10.0.9-0ubuntu1","10.0.110-10.0.10-0ubuntu3","10.0.111-10.0.11-0ubuntu1","10.0.112-10.0.12-0ubuntu1","10.0.112-10.0.12-0ubuntu2","10.0.113-10.0.13-0ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dotnet11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.100-11.0.0~rc3-0ubuntu1~26.10.1"}]}],"versions":["11.0.100-11.0.0~rc1-0ubuntu1","11.0.100-11.0.0~rc2-0ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3ubuntu0.1"}]}],"versions":["1.1.0-2build5","1.1.0-2build6","1.2.0-3","1.2.0-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~26.04.1"}]}],"versions":["10.0.100-10.0.0~rc1-0ubuntu1","10.0.100-10.0.0~rc2-0ubuntu1","10.0.100-10.0.0-0ubuntu1","10.0.100-10.0.0-0ubuntu2","10.0.101-10.0.1-0ubuntu1","10.0.101-10.0.1-0ubuntu2","10.0.101-10.0.1-0ubuntu3","10.0.102-10.0.2-0ubuntu1","10.0.103-10.0.3-0ubuntu1","10.0.104-10.0.4-0ubuntu1","10.0.105-10.0.5-0ubuntu1","10.0.107-10.0.7-0ubuntu1~26.04.1","10.0.108-10.0.8-0ubuntu1~26.04.1","10.0.109-10.0.9-0ubuntu1~26.04.1","10.0.110-10.0.10-0ubuntu1~26.04.1","10.0.111-10.0.11-0ubuntu1~26.04.1","10.0.112-10.0.12-0ubuntu1~26.04.1","10.0.113-10.0.13-0ubuntu1~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-2ubuntu0.1"}]}],"versions":["1.0.9-2build3","1.0.9-2build4","1.0.9-2build5","1.0.9-2build6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1"}]}],"versions":["1.0.9-2build8","1.1.0-1","1.1.0-2~build1","1.1.0-2","1.1.0-2build1","1.1.0-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-4ubuntu0.1"}]}],"versions":["1.2.0-3build1","1.2.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3ubuntu0.1"}]}],"versions":["1.1.0-2build5","1.1.0-2build6","1.2.0-3","1.2.0-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1~16.04.2+esm1"}]}],"versions":["0.2.0+dfsg-1","0.3.0+dfsg-1","0.3.0+dfsg-2","0.3.0+dfsg-2ubuntu1","1.0.3-1ubuntu1~16.04.1","1.0.3-1ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu1.3+esm1"}]}],"versions":["0.6.0-1build1","1.0.2-2","1.0.2-3","1.0.3-1ubuntu1","1.0.3-1ubuntu1.2","1.0.3-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-6ubuntu0.1+esm1"}]}],"versions":["1.0.7-2","1.0.7-2build1","1.0.7-4","1.0.7-5","1.0.7-6","1.0.7-6build1","1.0.7-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-8.0.33-0ubuntu1~22.04.1"}]}],"versions":["8.0.102-8.0.2-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.2","8.0.105-8.0.5-0ubuntu1~22.04.1","8.0.107-8.0.7-0ubuntu1~22.04.1","8.0.108-8.0.8-0ubuntu1~22.04.1","8.0.110-8.0.10-0ubuntu1~22.04.1","8.0.111-8.0.11-0ubuntu1~22.04.1","8.0.112-8.0.12-0ubuntu1~22.04.1","8.0.114-8.0.14-0ubuntu1~22.04.1","8.0.115-8.0.15-0ubuntu1~22.04.1","8.0.116-8.0.16-0ubuntu1~22.04.1","8.0.117-8.0.17-0ubuntu1~22.04.1","8.0.118-8.0.18-0ubuntu1~22.04.1","8.0.119-8.0.19-0ubuntu1~22.04.1","8.0.120-8.0.20-0ubuntu1~22.04.1","8.0.121-8.0.21-0ubuntu1~22.04.1","8.0.122-8.0.22-0ubuntu1~22.04.1","8.0.123-8.0.23-0ubuntu1~22.04.1","8.0.124-8.0.24-0ubuntu1~22.04.1","8.0.125-8.0.25-0ubuntu1~22.04.1","8.0.126-8.0.26-0ubuntu1~22.04.1","8.0.127-8.0.27-0ubuntu1~22.04.1","8.0.128-8.0.28-0ubuntu1~22.04.1","8.0.129-8.0.29-0ubuntu1~22.04.1","8.0.130-8.0.30-0ubuntu1~22.04.1","8.0.131-8.0.31-0ubuntu1~22.04.1","8.0.132-8.0.32-0ubuntu1~22.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~24.04.1"}]}],"versions":["10.0.100-10.0.0-0ubuntu1~24.04.1","10.0.101-10.0.1-0ubuntu1~24.04.2","10.0.103-10.0.3-0ubuntu1~24.04.1","10.0.104-10.0.4-0ubuntu1~24.04.1","10.0.105-10.0.5-0ubuntu1~24.04.1","10.0.106-10.0.6-0ubuntu1~24.04.1","10.0.107-10.0.7-0ubuntu1~24.04.1","10.0.108-10.0.8-0ubuntu1~24.04.1","10.0.109-10.0.9-0ubuntu1~24.04.1","10.0.110-10.0.10-0ubuntu1~24.04.1","10.0.111-10.0.11-0ubuntu1~24.04.1","10.0.112-10.0.12-0ubuntu1~24.04.1","10.0.113-10.0.13-0ubuntu1~24.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.133-8.0.33-0ubuntu1~24.04.1"}]}],"versions":["8.0.100-8.0.0~rc1-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu2","8.0.100-8.0.0-0ubuntu1","8.0.100-8.0.0-0ubuntu2","8.0.101-8.0.1-0ubuntu1","8.0.101-8.0.1-0ubuntu2","8.0.102-8.0.2-0ubuntu1","8.0.103-8.0.3-0ubuntu2","8.0.103-8.0.3-0ubuntu3","8.0.104-8.0.4-0ubuntu1","8.0.105-8.0.5-0ubuntu1~24.04.1","8.0.107-8.0.7-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.2","8.0.110-8.0.10-0ubuntu1~24.04.1","8.0.111-8.0.11-0ubuntu1~24.04.1","8.0.112-8.0.12-0ubuntu1~24.04.1","8.0.114-8.0.14-0ubuntu1~24.04.1","8.0.115-8.0.15-0ubuntu1~24.04.1","8.0.116-8.0.16-0ubuntu1~24.04.1","8.0.117-8.0.17-0ubuntu1~24.04.1","8.0.118-8.0.18-0ubuntu1~24.04.1","8.0.119-8.0.19-0ubuntu1~24.04.1","8.0.120-8.0.20-0ubuntu1~24.04.1","8.0.121-8.0.21-0ubuntu1~24.04.1","8.0.122-8.0.22-0ubuntu1~24.04.1","8.0.123-8.0.23-0ubuntu1~24.04.1","8.0.124-8.0.24-0ubuntu1~24.04.1","8.0.125-8.0.25-0ubuntu1~24.04.1","8.0.126-8.0.26-0ubuntu1~24.04.1","8.0.127-8.0.27-0ubuntu1~24.04.1","8.0.128-8.0.28-0ubuntu1~24.04.1","8.0.129-8.0.29-0ubuntu1~24.04.1","8.0.130-8.0.30-0ubuntu1~24.04.1","8.0.131-8.0.31-0ubuntu1~24.04.1","8.0.132-8.0.32-0ubuntu1~24.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~26.10.1"}]}],"versions":["10.0.105-10.0.5-0ubuntu1","10.0.107-10.0.7-0ubuntu1~26.04.1","10.0.108-10.0.8-0ubuntu1","10.0.109-10.0.9-0ubuntu1","10.0.110-10.0.10-0ubuntu3","10.0.111-10.0.11-0ubuntu1","10.0.112-10.0.12-0ubuntu1","10.0.112-10.0.12-0ubuntu2","10.0.113-10.0.13-0ubuntu1~26.10.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dotnet11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.100-11.0.0~rc3-0ubuntu1~26.10.1"}]}],"versions":["11.0.100-11.0.0~rc1-0ubuntu1","11.0.100-11.0.0~rc2-0ubuntu1~26.10.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dotnet10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.114-10.0.14-0ubuntu1~26.04.1"}]}],"versions":["10.0.100-10.0.0~rc1-0ubuntu1","10.0.100-10.0.0~rc2-0ubuntu1","10.0.100-10.0.0-0ubuntu1","10.0.100-10.0.0-0ubuntu2","10.0.101-10.0.1-0ubuntu1","10.0.101-10.0.1-0ubuntu2","10.0.101-10.0.1-0ubuntu3","10.0.102-10.0.2-0ubuntu1","10.0.103-10.0.3-0ubuntu1","10.0.104-10.0.4-0ubuntu1","10.0.105-10.0.5-0ubuntu1","10.0.107-10.0.7-0ubuntu1~26.04.1","10.0.108-10.0.8-0ubuntu1~26.04.1","10.0.109-10.0.9-0ubuntu1~26.04.1","10.0.110-10.0.10-0ubuntu1~26.04.1","10.0.111-10.0.11-0ubuntu1~26.04.1","10.0.112-10.0.12-0ubuntu1~26.04.1","10.0.113-10.0.13-0ubuntu1~26.04.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trufflehog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.99.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.11.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}]}],"products":[{"vendor":"7-zip","product":"p7zip"},{"vendor":"andybalholm","product":"brotli"},{"vendor":"anthropic","product":"bun"},{"vendor":"apache","product":"arrow"},{"vendor":"clickhouse","product":"clickhouse"},{"vendor":"debian","product":"debian_linux"},{"vendor":"duckdb","product":"duckdb"},{"vendor":"envoyproxy","product":"envoy"},{"vendor":"google","product":"brotli"},{"vendor":"google","product":"woff2"},{"vendor":"google llc","product":"brotli"},{"vendor":"istio","product":"istio"},{"vendor":"mcmilk","product":"7-zip-zstd"},{"vendor":"microsoft","product":".net"},{"vendor":"nodejs","product":"node.js"},{"vendor":"python-hyper","product":"brotlicffi"},{"vendor":"siemens","product":"calibre"},{"vendor":"siemens","product":"calibre ice"},{"vendor":"siemens","product":"capital"},{"vendor":"siemens","product":"cloud connector configurator"},{"vendor":"siemens","product":"common configurator on device (cc on edge)"},{"vendor":"siemens","product":"common configurator (cc on iem)"},{"vendor":"siemens","product":"common_configurator"},{"vendor":"siemens","product":"comos walkinside"},{"vendor":"siemens","product":"comos_walkinside"},{"vendor":"siemens","product":"data flow monitoring"},{"vendor":"siemens","product":"data_flow_monitoring"},{"vendor":"siemens","product":"databus configurator"},{"vendor":"siemens","product":"dataxess configurator"},{"vendor":"siemens","product":"dataxess_configurator"},{"vendor":"siemens","product":"designcenter x essentials"},{"vendor":"siemens","product":"desigo cc family v8"},{"vendor":"siemens","product":"desigo cc family v9"},{"vendor":"siemens","product":"edge opc ua server configurator"},{"vendor":"siemens","product":"edge_opc_ua_server_configurator"},{"vendor":"siemens","product":"flow creator configurator"},{"vendor":"siemens","product":"flow_creator_configurator"},{"vendor":"siemens","product":"gdap (gproms digital application platform)"},{"vendor":"siemens","product":"gridscale x dsa"},{"vendor":"siemens","product":"gridscale x pss®e"},{"vendor":"siemens","product":"heliox dual port 60kw"},{"vendor":"siemens","product":"heliox flex pro"},{"vendor":"siemens","product":"hyperlynx"},{"vendor":"siemens","product":"industrial edge hub"},{"vendor":"siemens","product":"industrial edge management cloud"},{"vendor":"siemens","product":"industrial_edge_cloud_connector_configurator"},{"vendor":"siemens","product":"industrial_edge_databus_configurator"},{"vendor":"siemens","product":"industrial_edge_hub"},{"vendor":"siemens","product":"industrial_edge_management_cloud"},{"vendor":"siemens","product":"innexis architecture native acceleration 2026"},{"vendor":"siemens","product":"innexis_architecture_native_acceleration"},{"vendor":"siemens","product":"insights hub"},{"vendor":"siemens","product":"insights_hub"},{"vendor":"siemens","product":"opcenter connect electronics"},{"vendor":"siemens","product":"opcenter connect mom"},{"vendor":"siemens","product":"opcenter execution core"},{"vendor":"siemens","product":"opcenter execution discrete"},{"vendor":"siemens","product":"opcenter execution foundation"},{"vendor":"siemens","product":"opcenter execution pharma"},{"vendor":"siemens","product":"opcenter execution process"},{"vendor":"siemens","product":"opcenter intelligence"},{"vendor":"siemens","product":"opcenter intra plant logistics"},{"vendor":"siemens","product":"opcenter quality"},{"vendor":"siemens","product":"opcenter rdnl"},{"vendor":"siemens","product":"opcenter x"},{"vendor":"siemens","product":"opcenter_connect_electronics"},{"vendor":"siemens","product":"opcenter_connect_manufacturing_operations_management"},{"vendor":"siemens","product":"opcenter_execution_core"},{"vendor":"siemens","product":"opcenter_execution_discrete"},{"vendor":"siemens","product":"opcenter_execution_foundation"},{"vendor":"siemens","product":"opcenter_execution_pharma"},{"vendor":"siemens","product":"opcenter_execution_process"},{"vendor":"siemens","product":"opcenter_intelligence"},{"vendor":"siemens","product":"opcenter_quality"},{"vendor":"siemens","product":"opcenter_rd\\\u0026l"},{"vendor":"siemens","product":"opcenter_x"},{"vendor":"siemens","product":"pads pro essentials"},{"vendor":"siemens","product":"pads pro student edition"},{"vendor":"siemens","product":"pads professional"},{"vendor":"siemens","product":"pads_professional"},{"vendor":"siemens","product":"pathway to learning engineering"},{"vendor":"siemens","product":"pave360 automotive 2026"},{"vendor":"siemens","product":"pave360_automotive"},{"vendor":"siemens","product":"polarion"},{"vendor":"siemens","product":"process preparation x"},{"vendor":"siemens","product":"process_preparation_x"},{"vendor":"siemens","product":"project server web administration tool"},{"vendor":"siemens","product":"ruggedcom ape1808"},{"vendor":"siemens","product":"ruggedcom_ape1808_firmware"},{"vendor":"siemens","product":"sicharge flex"},{"vendor":"siemens","product":"sicharge uc"},{"vendor":"siemens","product":"sifinity go"},{"vendor":"siemens","product":"sifinity setup"},{"vendor":"siemens","product":"simatic braumat"},{"vendor":"siemens","product":"simatic profiling tool"},{"vendor":"siemens","product":"simatic sistar"},{"vendor":"siemens","product":"simatic wincc companion"},{"vendor":"siemens","product":"simatic wincc oa v3.20"},{"vendor":"siemens","product":"simatic wincc oa v3.21"},{"vendor":"siemens","product":"simatic wincc runtime professional"},{"vendor":"siemens","product":"simatic wincc unified for industrial edge"},{"vendor":"siemens","product":"simatic wincc unified pc runtime"},{"vendor":"siemens","product":"simatic wincc unified siqence"},{"vendor":"siemens","product":"simatic wincc v7/v8"},{"vendor":"siemens","product":"simatic_braumat"},{"vendor":"siemens","product":"simatic_profiling_tool"},{"vendor":"siemens","product":"simatic_sistar"},{"vendor":"siemens","product":"simatic_wincc"},{"vendor":"siemens","product":"simatic_wincc_companion"},{"vendor":"siemens","product":"simatic_wincc_runtime"},{"vendor":"siemens","product":"simatic_wincc_unified_for_industrial_edge"},{"vendor":"siemens","product":"simatic_wincc_unified_pc_runtime"},{"vendor":"siemens","product":"simatic_wincc_unified_siqence"},{"vendor":"siemens","product":"simcenter executable digital twin"},{"vendor":"siemens","product":"simcenter studio"},{"vendor":"siemens","product":"simcenter_executable_digital_twin"},{"vendor":"siemens","product":"simcenter_studio"},{"vendor":"siemens","product":"solid edge"},{"vendor":"siemens","product":"teamcenter"},{"vendor":"siemens","product":"teamcenter share"},{"vendor":"siemens","product":"teamcenter v2412"},{"vendor":"siemens","product":"teamcenter v2506"},{"vendor":"siemens","product":"teamcenter v2512"},{"vendor":"siemens","product":"teamcenter v2606"},{"vendor":"siemens","product":"tia administrator"},{"vendor":"siemens","product":"tia_administrator"},{"vendor":"siemens","product":"tia_project-server_web_administration_tool"},{"vendor":"siemens","product":"user management component (umc)"},{"vendor":"siemens","product":"user_management_component"},{"vendor":"siemens","product":"versicharge ac series"},{"vendor":"siemens","product":"versicloud"},{"vendor":"siemens","product":"xpedition designer"},{"vendor":"siemens","product":"xpedition enterprise"},{"vendor":"siemens","product":"xpedition_designer"},{"vendor":"siemens","product":"xpedition_enterprise"},{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","tags":["patch","Third Party Advisory","advisory","web","fix","report"]},{"url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7","tags":["release-notes","third-party-advisory","Release Notes","article","advisory","web"]},{"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","tags":["Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","tags":["Third Party Advisory","advisory","article","web"]},{"url":"https://broccoli2shell.com","tags":["Third Party Advisory","advisory","web"]},{"url":"https://github.com/dotnet/announcements/issues/494","tags":["Issue Tracking","Mitigation","Third Party Advisory","advisory","report","web"]},{"url":"https://github.com/google/brotli/releases/tag/v1.2.1","tags":["Release Notes","article","web"]},{"url":"https://github.com/google/brotli/releases/tag/v1.1.1","tags":["Release Notes","article","web"]},{"url":"https://github.com/google/brotli/releases/tag/v1.0.10","tags":["Release Notes","article","web"]},{"url":"https://patchtheplanet.org/brotli","tags":["Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/16","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/03/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-898633.html","tags":["Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-443410.html","tags":["Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-045512.html","tags":["Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-678870.html","tags":["Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-242944.html","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","tags":["web","advisory"]},{"url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b","tags":["web","fix"]},{"url":"https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0","tags":["web"]},{"url":"https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6","tags":["web"]},{"url":"https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["web"]},{"url":"https://opensourcemalware.com/blog/node2shell-affects-python","tags":["web"]},{"url":"https://pypi.org/project/Brotli","tags":["web"]},{"url":"https://pypi.org/project/brotlicffi","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111497","tags":["web","advisory","report"]},{"url":"https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-111497","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10766","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6746","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6747","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6748","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6749","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6750","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6751","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6752","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6753","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6754","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6757","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6759","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6761","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6762","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6763","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6764","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6766","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6767","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6769","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6770","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6771","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6772","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6776","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6785","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6786","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460074","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460075","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460076","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460078","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460079","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460085","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460086","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460088","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460092","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460094","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460095","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460096","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460097","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460099","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460101","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460102","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460103","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460104","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460105","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460106","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460107","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460108","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460109","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460110","tags":["report"]},{"url":"https://bugzilla.redhat.com/2460112","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-10766.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-111497.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13537","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-13537.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90449","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-90449.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90495","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90495.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90501","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-90501.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92420","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-114148","tags":["report"]},{"url":"https://bugzilla.redhat.com/2562054","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92420.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92428","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-92428.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92492","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92492.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-111497","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792754583.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792755607.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792824525.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792824700.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792824879.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792827041.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792827285.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1792827522.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792832424.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792865919.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792867484.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111497.json","tags":["advisory"]},{"url":"https://github.com/google/brotli","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-111497","tags":["advisory"]},{"url":"https://github.com/yjh0502/erl-brotli/issues/23","tags":["web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-111497.html","tags":["web"]},{"url":"https://github.com/yjh0502/erl-brotli/releases/tag/v0.3.4","tags":["web"]},{"url":"https://github.com/yjh0502/erl-brotli/commit/1e2af9bebba40ee292abf51e19ac831c2658ca47","tags":["web"]},{"url":"https://github.com/yjh0502/erl-brotli/commit/7498e1c743c71a99636e8f897b6b016433830d6d","tags":["fix"]},{"url":"https://hex.pm/packages/brotli","tags":["package"]},{"url":"https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv","tags":["advisory"]},{"url":"https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42","tags":["fix"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4539","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4540","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4541","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4542","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4601","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4602","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4603","tags":["advisory"]},{"url":"https://pypi.org/project/Brotli/","tags":["package"]},{"url":"https://pypi.org/project/brotlicffi/","tags":["package"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90449","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90495","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90501","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92420","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562054","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92428","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92492","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98522","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98522","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624476-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1287778","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111497","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624518-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624556-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624597-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252945","tags":["report"]},{"url":"https://bugzilla.suse.com/1287779","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624600-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286561","tags":["report"]},{"url":"https://bugzilla.suse.com/1286563","tags":["report"]},{"url":"https://bugzilla.suse.com/1286564","tags":["report"]},{"url":"https://bugzilla.suse.com/1286565","tags":["report"]},{"url":"https://bugzilla.suse.com/1286566","tags":["report"]},{"url":"https://bugzilla.suse.com/1286567","tags":["report"]},{"url":"https://bugzilla.suse.com/1286570","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106074","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624601-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264928-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286385","tags":["report"]},{"url":"https://bugzilla.suse.com/1286955","tags":["report"]},{"url":"https://bugzilla.suse.com/1287809","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118004","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264945-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264957-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265036-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1276224","tags":["report"]},{"url":"https://bugzilla.suse.com/1286562","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105483","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265125-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265145-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-111497","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148","tags":["report"]},{"url":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8956-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8956-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8958-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-114148","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98432","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T13:35:41.975Z","modified":"2026-11-10T12:50:00.309Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-787","CWE-252"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-108169","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T13:35:41Z","modified":"2026-11-10T12:50:00Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"exploited_since":"2026-10-27","updated_at":"2026-11-10T14:21:09.632261Z"}],"ghsa":[{"id":"GHSA-9v8h-qqgm-4m35","title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T15:32:49Z","modified":"2026-11-03T17:10:28Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-252"],"updated_at":"2026-11-03T17:29:08.735014Z"}],"kev":[{"id":"CVE-2026-111497","title":"Google Brotli Unchecked Return Value Vulnerability","description":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","cwes":["CWE-252","CWE-787"],"kev":{"date_added":"2026-10-27","due_date":"2026-11-10","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37.19Z","modified":"2026-11-10T20:25:59.13Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-252","CWE-787"],"updated_at":"2026-11-10T22:21:29.992572Z"}],"osv":[{"id":"ALPINE-CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37.19Z","modified":"2026-11-03T06:32:52.462817533Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-111497","status":"published","published":"2026-10-24T06:06:19.923753Z","modified":"2026-10-30T07:15:05.438680847Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T13:35:41.975Z","modified":"2026-11-11T07:29:02.834130687Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-252","CWE-787"],"updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"DEBIAN-CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.      Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37.19Z","modified":"2026-11-11T09:47:34.242735087Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T17:34:47.901646Z"},{"id":"EEF-CVE-2026-111497","title":"Out-of-bounds write in the Brotli decoder bundled with erl-brotli","description":"## Summary\n\nOut-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to `brotli:decode/1` to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.\n\nerl-brotli compiles its own copy of the Google Brotli C sources under `c_src` into a NIF, and `brotli_decoder_decompress_stream` in `c_src/brotli_nif.c` hands the input to `BrotliDecoderDecompressStream`. In `c_src/dec/decode.c`, `DecodeBlockTypeAndLength` returns false for a block switch in a category with at most one block type, and the non-streaming callers `DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch` and `DecodeDistanceBlockSwitch` discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.\n\nThis issue affects brotli: from 0.3.0 before 0.3.4.\n\n## Impact\n\nAn attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses `Content-Encoding: br` responses with this package, can crash the Erlang VM and potentially run code inside it.","status":"published","published":"2026-10-22T13:35:41.975Z","modified":"2026-11-06T01:02:56.919672464Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-06T01:32:48.996681Z"},{"id":"GHSA-9v8h-qqgm-4m35","title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T15:32:49Z","modified":"2026-11-05T23:25:49.434824566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-252"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"OESA-2026-4539","title":"brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:02:42Z","modified":"2026-10-29T09:15:30.523976888Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4540","title":"brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:02:42Z","modified":"2026-10-29T09:15:31.247544961Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4541","title":"brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:02:43Z","modified":"2026-10-29T09:15:35.056711484Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4542","title":"brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:02:44Z","modified":"2026-10-29T09:15:25.479986599Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4601","title":"python-brotlicffi security update","description":"Python CFFI bindings to the Brotli library.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:03:27Z","modified":"2026-10-29T09:15:38.583911338Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4602","title":"python-brotlicffi security update","description":"Python CFFI bindings to the Brotli library.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:03:27Z","modified":"2026-10-29T09:15:38.580121553Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4603","title":"python-brotlicffi security update","description":"Python CFFI bindings to the Brotli library.\r\n\r\nSecurity Fix(es):\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.(CVE-2026-111497)","status":"published","published":"2026-10-29T09:03:28Z","modified":"2026-10-29T09:15:38.575137798Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"PYSEC-2026-4322","title":"Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","description":"CVE-2026-111497 (\"Node2Shell\") is an out-of-bounds write (CWE-787) in Google's\nBrotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous\nvalue for an invalid block switch, and the fast decode path discards it\n(CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder\ncontinue on corrupted state and write past the ring buffer. Upstream rates it\nCVSS 4.0 9.2 and classifies the impact as potential remote code execution.\n\nThe vulnerability is in Google's C library, not in Node.js specifically. The\nPyPI `Brotli` package is Google's CPython binding and compiles the same\nc/dec/decode.c that has the actual vulnerability. All `Brotli` releases up to\nand including 1.2.0 ship the vulnerable decoder; 1.2.1 contains the upstream\nfix (commit 0ed4268a) and differs from 1.2.0 only in that fix plus a version\nbump.\n\nThe decoder is reached whenever untrusted Brotli data is decompressed. With\n`Brotli` installed, common HTTP clients decode Brotli responses automatically\n(urllib3/requests, httpx with the brotli extra, aiohttp) and services that\naccept `Content-Encoding: br` request bodies decode inbound data, so the flaw\nis reachable from attacker-controlled input.\n","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-11-05T23:25:49.434824566Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"PYSEC-2026-4323","title":"Out-of-bounds write in the brotlicffi decoder (\"Node2Shell\") also affects the PyPI Brotli package","description":"CVE-2026-111497 (\"Node2Shell\") is an out-of-bounds write (CWE-787) in Google's\nBrotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous\nvalue for an invalid block switch, and the fast decode path discards it\n(CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder\ncontinue on corrupted state and write past the ring buffer. Upstream rates it\nCVSS 4.0 9.2 and classifies the impact as potential remote code execution.\n\nThe vulnerability is in Google's C library, not in Node.js specifically. The\nPyPI `Brotli` package is Google's CPython binding and compiles the same\nc/dec/decode.c that has the original vulnerability. All `Brotli` releases up to\nand including 1.2.0 ship the vulnerable decoder; 1.2.1 contains the upstream\nfix (commit 0ed4268a) and differs from 1.2.0 only in that fix plus a version\nbump.\n\nThe decoder is reached whenever untrusted Brotli data is decompressed. With\n`brotlicffi` installed, common HTTP clients decode Brotli responses automatically\n(urllib3/requests, httpx with the brotli extra, aiohttp) and services that\naccept `Content-Encoding: br` request bodies decode inbound data, so the flaw\nis reachable from attacker-controlled input.\n","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-11-05T23:25:49.434824566Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"RLSA-2026:90449","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. \n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:08:23.381701Z","modified":"2026-10-29T12:30:04.135550161Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90495","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. \n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:02.481469919Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90501","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. \n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:00:52.140894Z","modified":"2026-10-29T12:30:03.190160903Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92420","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.\n\nSDK version: 8.0.133\nRuntime version: 8.0.33\n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\nBug Fix(es) and Enhancement(s):\n\n* Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:Rocky Linux-291714)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-31T00:01:20.627732Z","modified":"2026-10-31T00:30:02.692057974Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92428","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.\n\nSDK version: 8.0.133\nRuntime version: 8.0.33\n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\nBug Fix(es) and Enhancement(s):\n\n* Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:Rocky Linux-291718)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-31T00:09:15.42589Z","modified":"2026-10-31T00:30:02.688384193Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92492","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.\n\nSDK version: 8.0.133\nRuntime version: 8.0.33\n\nSecurity Fix(es):\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\nBug Fix(es) and Enhancement(s):\n\n* Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:Rocky Linux-291717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-31T12:05:03.078979Z","modified":"2026-10-31T12:30:02.422345445Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98522","title":"Important: nodejs:26 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:26/nodejs: Rebase to the latest Node.js 26 release [rhel-9.9] (JIRA:Rocky Linux-289767)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.620223025Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-30T03:11:59.566204401Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"ALSA-2026:10766","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)\n  * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)\n  * firefox: thunderbird: Spoofing issue in the DOM: Core \u0026 HTML component (CVE-2026-6762)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)\n  * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)\n  * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)\n  * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)\n  * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)\n  * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)\n  * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)\n  * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)\n  * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)\n  * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)\n  * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)\n  * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)\n  * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)\n  * firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-6746)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-27T00:00:00Z","modified":"2026-10-29T11:12:08.909366802Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:13537","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)\n  * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)\n  * firefox: thunderbird: Spoofing issue in the DOM: Core \u0026 HTML component (CVE-2026-6762)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)\n  * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)\n  * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)\n  * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)\n  * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)\n  * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)\n  * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)\n  * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)\n  * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)\n  * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)\n  * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)\n  * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)\n  * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)\n  * firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-6746)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-10-29T11:12:05.167170741Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:90449","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.   \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:31:11.029738365Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90495","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.   \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.946705419Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90501","title":"Important: brotli security update","description":"Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.   \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:02:25.397215175Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92420","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  \n\nSDK version: 8.0.133  \nRuntime version: 8.0.33  \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:RHEL-291714)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T10:45:02.454375341Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92428","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  \n\nSDK version: 8.0.133  \nRuntime version: 8.0.33  \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:RHEL-291718)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T11:00:02.381116777Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92492","title":"Important: .NET 8.0 security, bug fix, and enhancement update","description":".NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  \n\nSDK version: 8.0.133  \nRuntime version: 8.0.33  \n\nSecurity Fix(es):  \n\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:RHEL-291717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-30T16:45:01.885656459Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-110384","title":"CVE-2026-111497 affecting package brotli for versions less than 1.2.1-1","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"AZL-111005","title":"CVE-2026-111497 affecting package rr 5.8.0-2","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111041","title":"CVE-2026-111497 affecting package nodejs for versions less than 24.22.1-1","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37Z","modified":"2026-11-05T07:22:58Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111518","title":"CVE-2026-111497 affecting package p7zip 16.02-23","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-112175","title":"CVE-2026-111497 affecting package qemu 10.1.0-2","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-22T14:17:37Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"BIT-brotli-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-29T08:38:40.345Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"BIT-dotnet-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-29T08:42:09.842Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"BIT-dotnet-sdk-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-29T08:42:09.098Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"BIT-node-2026-111497","description":"A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.","status":"published","published":"2026-10-23T08:48:26.837Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"BIT-node-min-2026-111497","description":"A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.","status":"published","published":"2026-10-23T08:48:26.837Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"BIT-powershell-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","status":"published","published":"2026-10-29T08:57:22.361Z","modified":"2026-11-05T23:25:49.434824566Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"CLSA-2026-1792754583","title":"brotli: Fix of CVE-2026-111497","description":"- CVE-2026-111497: report an error on an invalid block switch in\n  the decoder instead of silently ignoring it","status":"published","published":"2026-10-23T11:23:13Z","modified":"2026-10-26T09:30:59.815508194Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792755607","title":"brotli: Fix of CVE-2026-111497","description":"- CVE-2026-111497: report an error on an invalid block switch in\n  the decoder instead of silently ignoring it","status":"published","published":"2026-10-23T11:40:17Z","modified":"2026-10-26T09:31:36.742632056Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792824525","title":"Fix CVE(s): CVE-2026-111497","description":"   * SECURITY UPDATE: Invalid stream not detected during block switch decoding\n     - debian/patches/CVE-2026-111497.patch: return an error code from the\n       literal/command/distance block-switch decoders and abort decoding with\n       BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c,\n       c/include/brotli/decode.h\n     - CVE-2026-111497","status":"published","published":"2026-10-24T06:48:56Z","modified":"2026-10-26T09:32:04.927275802Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792824700","title":"Fix CVE(s): CVE-2026-111497","description":"   * SECURITY UPDATE: Out-of-bounds write via invalid block switch in decoder\n     - debian/patches/CVE-2026-111497.patch: abort decoding with\n       BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in c/dec/decode.c\n     - CVE-2026-111497","status":"published","published":"2026-10-24T06:51:51Z","modified":"2026-10-26T09:32:06.363776524Z","updated_at":"2026-11-02T15:43:54.981307Z"}]},"sources_more":{"osv":44}}