Threats affecting pkg:pypi/brotli

This security update for python-Brotli addresses two vulnerabilities: CVE-2025-6176, a denial of service (DoS) flaw in the Brotli decompression, and CVE-2026-111497, an out-of-bounds write in the Brotli decoder that could allow remote code execution. The update to version 1.2.1 includes improvements such as static initialization to reduce binary size and the ability to limit decoder output for security purposes.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.