Brotli Vulnerability — Ubuntu Security Update (USN-8956-2)
USN-8956-2 extends the Brotli fix (CVE-2026-111497 — the crafted-stream memory flaw behind the Node.js advisory, CVSS 9.8 per NVD) to Ubuntu's EOL long-term-support branches: 16.04 LTS, 18.04 LTS and 20.04 LTS. If you run one of these branches with the Brotli library installed, apply the update: sudo apt update && sudo apt upgrade brotli.
What this means under a SharedLicense license
This closes the same Brotli decoder vulnerability on Ubuntu branches that no longer receive standard security updates — servers staying on EOL branches without this backport remain exposed to crashes or code execution from crafted compressed input.
-
USN-8956-2
Publication date
27 October 2026
Overview
Brotli could be made to crash or run programs if it received specially
crafted input.
Releases
Packages
- brotli – lossless compression algorithm and format (command line utility)
Details
USN-8956-1 fixed a vulnerability in Brotli. This update provides the
corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
USN-8956-1 fixed a vulnerability in Brotli. This update provides the
corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
|
20.04
LTS focal |
brotli –
1.0.7-6ubuntu0.1+esm1 Ubuntu Pro |
||
|
libbrotli1 –
1.0.7-6ubuntu0.1+esm1 Ubuntu Pro |
|||
|
python3-brotli –
1.0.7-6ubuntu0.1+esm1 Ubuntu Pro |
|||
|
18.04
LTS bionic |
brotli –
1.0.3-1ubuntu1.3+esm1 Ubuntu Pro |
||
|
libbrotli1 –
1.0.3-1ubuntu1.3+esm1 Ubuntu Pro |
|||
|
python-brotli –
1.0.3-1ubuntu1.3+esm1 Ubuntu Pro |
|||
|
python3-brotli –
1.0.3-1ubuntu1.3+esm1 Ubuntu Pro |
|||
|
16.04
LTS xenial |
brotli –
1.0.3-1ubuntu1~16.04.2+esm1 Ubuntu Pro |
||
|
libbrotli1 –
1.0.3-1ubuntu1~16.04.2+esm1 Ubuntu Pro |
|||
|
python-brotli –
1.0.3-1ubuntu1~16.04.2+esm1 Ubuntu Pro |
|||
|
python3-brotli –
1.0.3-1ubuntu1~16.04.2+esm1 Ubuntu Pro |
|||
References
Related notices
Frequently Asked Questions
What is USN-8956-2?
Which CVE does this update fix?
I run Ubuntu 20.04 LTS — am I affected?
How does this relate to the Node.js Brotli advisory?
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System