Threats affecting pkg:brew/fonttools

CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Fixed versions are available, and users should update to versions 1.0.10, 1.1.1, 1.2.1 or later.

Scrapy versions up to 2.13.3 contain a denial of service (DoS) vulnerability due to improper handling of brotli decompression. The existing protection against decompression bombs does not cover the brotli compression variant, allowing crafted data to cause excessive memory consumption and crash clients with less than 80GB of memory. This flaw is mitigated by security enhancements introduced in brotli version 1.2.0 and fixed in fonttools versions 4.45.0 and 4.60.1_2.