References
One row per claim. Sources list the vendor, registry or tracker first, then OSV or NVD. Link to a row with its number, for example references.html#r005.
| # | Stack | Claim | Value | Sources | Note |
|---|---|---|---|---|---|
| R001–R004 · Upstream Brotli | |||||
| R001 | Brotli 1.0.x | Affected range and fix | Affected: 1.0.3 to 1.0.9Fixed: 1.0.10 | Released 2026-10-21. | |
| R002 | Brotli 1.1.x | Affected range and fix | Affected: 1.1.0Fixed: 1.1.1 | Released 2026-10-21. | |
| R003 | Brotli 1.2.x | Affected range and fix | Affected: 1.2.0Fixed: 1.2.1 | Released 2026-10-21. | |
| R004 | Brotli before 1.0.3 | Not affected | Below 1.0.3 | The flawed code path first appears in 1.0.3. | |
| R005–R011 · Node.js | |||||
| R005 | Node.js 22.x | Affected range and fix | Affected: below 22.23.4Fixed: 22.23.4 | ||
| R006 | Node.js 24.x | Affected range and fix | Affected: below 24.22.1Fixed: 24.22.1 | 24.22.2 also contains the fix. | |
| R007 | Node.js 26.x | Affected range and fix | Affected: below 26.12.1Fixed: 26.12.1 | 26.13.0 LTS also contains the fix. | |
| R008 | Node.js 20.x | Affected, no fix | Affected: every 20.xFixed: none | End of life since 2026-04-30. | |
| R009 | Node.js 23.x | Affected, no fix | Affected: every 23.xFixed: none | End of life since 2025-06-01. | |
| R010 | Node.js 25.x | Affected, no fix | Affected: every 25.xFixed: none | End of life since 2026-06-01; Bitnami's OSV data leaves it out. | |
| R011 | Older Node.js lines | Affected, no fix | Affected: lines with Brotli, from 10.16.0 and 11.7.0Fixed: none | Releases before those have no Brotli decoder. | |
| R012–R014 · Bun | |||||
| R012 | Bun | Affected range | Affected: 1.0.21 to below 1.4.4 | 1.0.21 loaded the system libbrotlidec at runtime. | |
| R013 | Bun | Fix | Fixed: 1.4.4 | No GitHub Advisory DB or OSV entry, so scanners miss it. | |
| R014 | Bun compiled executables | Fix | Fixed: rebuild with 1.4.4 or later | Each executable embeds the Bun runtime it was built with. | |
| R015–R026 · .NET and Microsoft | |||||
| R015 | .NET 8 | Affected range and fix | Affected: below runtime 8.0.33Fixed: runtime 8.0.33 (SDK 8.0.133 or 8.0.427) | Runtime version, not SDK. | |
| R016 | .NET 9 | Affected range and fix | Affected: below runtime 9.0.22Fixed: runtime 9.0.22 (SDK 9.0.123 or 9.0.320) | Runtime version, not SDK. | |
| R017 | .NET 10 | Affected range and fix | Affected: below runtime 10.0.14Fixed: runtime 10.0.14 (SDK 10.0.114 or 10.0.403) | Runtime version, not SDK. | |
| R018 | .NET 11 | Affected range and fix | Affected: previews and RCs before 11.0.0-rc.3.26522.148Fixed: runtime 11.0.0-rc.3.26522.148 (SDK 11.0.100-rc.3.26522.148) | Runtime version, not SDK. | |
| R019 | .NET self-contained and NativeAOT apps | Fix | Fixed: republish with a fixed SDK and runtime pack | Updating the machine's shared runtime does not fix them. | |
| R020 | PowerShell 7.4 | Fix | Fixed: 7.4.22 | ||
| R021 | PowerShell 7.5 | Fix | Fixed: 7.5.13 | ||
| R022 | PowerShell 7.6 | Fix | Fixed: 7.6.9 | ||
| R023 | Visual Studio 2019 16.11 | Fix | Fixed: 16.11.61 | ||
| R024 | Visual Studio 2022 17.14 | Fix | Fixed: 17.14.43 | ||
| R025 | Visual Studio 2026 18.11 | Fix | Fixed: 18.11.2 | ||
| R026 | Visual Studio 2017 15.9 | Affected, no fix | Affected: 15.9Fixed: no build listed | No fixed release. | |
| R027–R040 · Python | |||||
| R027 | PyPI Brotli | Affected range and fix | Affected: below 1.2.1Fixed: 1.2.1 | The first affected PyPI release is 1.0.4. | |
| R028 | brotlicffi | Affected range and fix | Affected: below 1.2.1.0Fixed: 1.2.1.0 | The first affected release is 1.0.9.0. | |
| R029 | curl_cffi | Affected range and fix | Affected: below 0.17.0Fixed: 0.17.0 | No GHSA or OSV entry, so scanners miss it. | |
| R030 | Pillow | Affected, no fix | Affected: 13.0.0 wheels bundle libbrotli 1.2.0Fixed: no release yet | The pip version does not map to a Brotli version. | |
| R031 | duckdb | Affected, no fix | Affected: vendors a Brotli 1.1.0 decoderFixed: none | The pip version does not map to a Brotli version. | |
| R032 | Distro python3-brotli | Version misleads | python3-brotli 1.0.9-2+deb12u1 reports Brotli 1.0.9 in pip | Judge it by the OS package row. | |
| R033 | Scrapy | Depends on Brotli | 2.19.0 requires brotli>=1.2.0 | ||
| R034 | flask-compress | Depends on Brotli | 1.25 requires brotli, unpinned | ||
| R035 | selenium-wire | Depends on Brotli | 5.1.0 requires brotli>=1.0.9 | Abandoned. | |
| R036 | django-compression-middleware | Depends on Brotli | 0.5.0 requires Brotli, unpinned | ||
| R037 | urllib3 and requests | Brotli through an extra | urllib3[brotli]; requests gets it only through urllib3 | Decodes Brotli whenever it is importable. | |
| R038 | httpx | Brotli through an extra | httpx[brotli] | Decodes Brotli whenever it is importable. | |
| R039 | aiohttp | Brotli through an extra | aiohttp[speedups] | Decodes Brotli whenever it is importable. | |
| R040 | pipdeptree | Minimum version | --extras active needs pipdeptree 3.0 or later | The default mode hides extras installed from the command line. | |
| R041–R043 · Java | |||||
| R041 | Brotli4j brotli4j | Affected range and fix | Affected: 1.23.0 and earlierFixed: 1.24.0 | No GitHub Advisory DB or OSV entry, so scanners miss it. | |
| R042 | Brotli4j native-* and all | Affected range and fix | Affected: 1.23.0 and earlierFixed: 1.24.0 | Native jar versions can differ from the brotli4j version. | |
| R043 | jvmbrotli | Affected, no fix | Affected: every version, bundles Brotli 1.0.7Fixed: none, replace it | Abandoned since 2019. | |
| R044–R045 · Ruby | |||||
| R044 | brotli gem | Affected range and fix | Affected: 0.2.1 to 0.9.0Fixed: 0.9.1 | No Ruby Advisory DB or OSV entry, so bundler-audit misses it. | |
| R045 | brotli gem, system-linked | Fixed by the OS update | 0.4.0 and later, built with libbrotli-dev present | These builds follow the OS libbrotli, not the gem version. | |
| R046–R048 · Go | |||||
| R046 | andybalholm/brotli | Affected range and fix | Affected: below v1.2.7 (same flaw, crash only)Fixed: v1.2.7 | Not in the Go vuln DB, so govulncheck misses it. | |
| R047 | google/brotli cbrotli | Follows the host library | No C code of its own; cgo links the build host's libbrotli Fixed: patch the OS library and restart | Rebuild if linked statically or shipped inside an image. | |
| R048 | cbrotli under Bazel | Fix | Fixed: move @org_brotli to 1.2.1 and rebuild | Bazel compiles the C decoder from source, so the OS patch does not reach it. | |
| R049–R055 · Rust | |||||
| R049 | brotlic-sys | Affected, no fix | Affected: 0.2.2 and earlier bundle Brotli 1.0.9Fixed: none on crates.io | BROTLI_VERSION 0x1000009, no fix marker. | |
| R050 | brotlic | Affected, no fix | Affected: 0.8.2 and earlier, through brotlic-sysFixed: none on crates.io | No RustSec entry yet, so cargo audit misses it. | |
| R051 | compu-brotli-sys 1.2.1 | Bundles an unfixed decoder | 1.2.1 ships the upstream v1.2.0 decoder | Published 2026-10-24, not yanked, no fix marker. | |
| R052 | compu-brotli-sys 1.0.10 | Bundles an unfixed decoder | 1.0.10 ships the upstream v1.0.9 decoder | The crate number does not match the Brotli version inside. | |
| R053 | compu-brotli-sys 1.2.0 | Fixed but yanked | 1.2.0 has the fix marker and is yanked | No fixed -sys release is available on crates.io. | |
| R054 | brotli (pure Rust) | Not affected | No advisory for any version | Fix for -sys users: move to this crate. | |
| R055 | brotli-decompressor | Not affected | No advisory for any version | 6.2.0 hardens the same code path. | |
| R056–R063 · Debian | |||||
| R056 | Debian 12 bookworm | Affected range and fix | Affected: below 1.0.9-2+deb12u1Fixed: 1.0.9-2+deb12u1 | Shipped through Debian LTS. | |
| R057 | Debian 12 bookworm armel, mips64el, mipsel, s390x | Affected, no fix | Affected: 1.0.9-2+b6Fixed: no build | Debian LTS does not build these architectures. | |
| R058 | Debian 13 trixie | Affected range and fix | Affected: below 1.1.0-2+deb13u1Fixed: 1.1.0-2+deb13u1 | ||
| R059 | Debian forky (testing) | Affected, no fix | Affected: 1.2.0-4Fixed: none yet | The sid fix is blocked from migrating as of 2026-10-29. | |
| R060 | Debian sid (unstable) | Affected range and fix | Affected: below 1.2.0-4.1Fixed: 1.2.0-4.1 | ||
| R061 | Debian 11 bullseye | Fixed only in paid ELTS | Affected: below 1.0.9-2+deb11u1Fixed: 1.0.9-2+deb11u1 (Freexian ELTS) | Debian LTS for bullseye ended 2026-08-31. | |
| R062 | Debian 10 buster | Fixed only in paid ELTS | Affected: below 1.0.7-2+deb10u2Fixed: 1.0.7-2+deb10u2 (Freexian ELTS) | Not in the Debian archive. | |
| R063 | Debian nodejs | Uses the system library | Built with --shared-brotliFixed: by the libbrotli1 update | node --version says nothing about the decoder here. | |
| R064–R072 · Ubuntu | |||||
| R064 | Ubuntu 26.10 | Affected range and fix | Affected: below 1.2.0-4ubuntu0.1Fixed: 1.2.0-4ubuntu0.1 | ||
| R065 | Ubuntu 26.04 LTS | Affected range and fix | Affected: below 1.2.0-3ubuntu0.1Fixed: 1.2.0-3ubuntu0.1 | ||
| R066 | Ubuntu 24.04 LTS | Affected range and fix | Affected: below 1.1.0-2ubuntu0.1Fixed: 1.1.0-2ubuntu0.1 | ||
| R067 | Ubuntu 22.04 LTS | Affected range and fix | Affected: below 1.0.9-2ubuntu0.1Fixed: 1.0.9-2ubuntu0.1 | ||
| R068 | Ubuntu 20.04 LTS | Affected range and fix | Affected: below 1.0.7-6ubuntu0.1+esm1Fixed: 1.0.7-6ubuntu0.1+esm1 | Ubuntu Pro (esm-infra) only. | |
| R069 | Ubuntu 18.04 LTS | Affected range and fix | Affected: below 1.0.3-1ubuntu1.3+esm1Fixed: 1.0.3-1ubuntu1.3+esm1 | Ubuntu Pro (esm-infra) only. | |
| R070 | Ubuntu 16.04 LTS | Affected range and fix | Affected: below 1.0.3-1ubuntu1~16.04.2+esm1Fixed: 1.0.3-1ubuntu1~16.04.2+esm1 | Ubuntu Pro only. | |
| R071 | Ubuntu 22.04 and later nodejs | Uses the system library | Fixed: by the libbrotli1 update | Ubuntu marks these not affected because they use system Brotli. | |
| R072 | Ubuntu 20.04 nodejs | Affected, no fix | Affected: nodejs 10.19Fixed: none | Bundles its own Brotli, so updating libbrotli1 does not cover it. | |
| R073–R094 · Other Linux | |||||
| R073 | RHEL 10 | Affected range and fix | Affected: below 1.1.0-8.el10_2.1Fixed: 1.1.0-8.el10_2.1 | Keeps the old upstream version number. | |
| R074 | RHEL 9 | Affected range and fix | Affected: below 1.0.9-10.el9_8.1Fixed: 1.0.9-10.el9_8.1 | Keeps the old upstream version number. | |
| R075 | RHEL 8 | Affected range and fix | Affected: below 1.0.6-5.el8_10Fixed: 1.0.6-5.el8_10 | Keeps the old upstream version number. | |
| R076 | AlmaLinux | Backport under the old version | Fixed: rebuilds of the RHEL updates above | ||
| R077 | Amazon Linux 2023 | Affected range and fix | Affected: below 1.1.0-1.amzn2023.0.2Fixed: 1.1.0-1.amzn2023.0.2 | Keeps the old upstream version number. | |
| R078 | SLE 15 | Affected, no fix | Affected: 1.0.7 buildsFixed: none released ( 1.0.7-150200.3.8.1 in QA) | SUSE lists the overall state as Pending. | |
| R079 | openSUSE Tumbleweed | Fix | Fixed: 1.2.1-1.1 or later | Ships upstream 1.2.1, so the version is enough. | |
| R080 | Fedora 46 | Fix | Fixed: brotli-1.2.1-1.fc46 (stable) | Ships upstream 1.2.1, so the version is enough. | |
| R081 | Fedora 45 | Fix | Fixed: brotli-1.2.1-1.fc45 (stable) | Ships upstream 1.2.1, so the version is enough. | |
| R082 | Fedora 44 | Fix | Fixed: brotli-1.2.1-1.fc44 (stable) | Ships upstream 1.2.1, so the version is enough. | |
| R083 | Fedora 43 | Fix in testing only | Fixed: brotli-1.2.1-1.fc43 in updates-testing | Not yet in the stable updates repository. | |
| R084 | Arch Linux | Fix | Fixed: 1.2.1-1 in core | Arch has no CVE record for this. | |
| R085 | Alpine 3.21 | Fix | Fixed: 1.1.1-r0 | ||
| R086 | Alpine 3.22 | Fix | Fixed: 1.1.1-r0 | Alpine's secdb has no entry, so secdb-based scanners may miss stale images. | |
| R087 | Alpine 3.23 | Fix | Fixed: 1.2.1-r0 | ||
| R088 | Alpine 3.24 | Fix | Fixed: 1.2.1-r0 | ||
| R089 | Alpine edge | Fix | Fixed: 1.2.1-r0 | ||
| R090 | Alpine 3.20 | Affected, no fix | Affected: 1.1.0-r2Fixed: none | No fixed release. | |
| R091 | Alpine 3.19 | Affected, no fix | Affected: 1.1.0-r1Fixed: none | No fixed release. | |
| R092 | Firefox and Thunderbird (RHEL) | Bundles its own Brotli | Fixed: Red Hat updates from April and May 2026 | Not shown by rpm -qa | grep brotli. | |
| R093 | nodejs:24 and nodejs:26 modules (RHEL 8, 9) | Bundles its own Brotli | Affected: per Red Hat, no fix listed | Not shown by rpm -qa | grep brotli. | |
| R094 | ghostscript, qemu, ovmf, texlive, mozjs (SUSE) | Bundles its own Brotli | Affected or in progress, per SUSE | Not shown by rpm -qa | grep brotli. | |
| R095–R101 · Vendored source | |||||
| R095 | Fixed upstream source | Contains the fix marker | BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in decode.c of v1.0.10, v1.1.1, v1.2.1 | ||
| R096 | Unfixed upstream source | Lacks the fix marker | Absent from decode.c of v1.0.9, v1.1.0, v1.2.0 | ||
| R097 | Source older than 1.0.3 | Lacks the marker, not affected | Below 1.0.3 | The grep lists these too; they predate the flaw. | |
| R098 | Debian security patches | Add the fix marker | bookworm 1.0.9-2+deb12u1, trixie 1.1.0-2+deb13u1, sid 1.2.0-4.1 | Applied at build time from debian/patches/. | |
| R099 | Ubuntu security patches | Add the fix marker | 1.2.0-4ubuntu0.1, 1.2.0-3ubuntu0.1, 1.1.0-2ubuntu0.1, 1.0.9-2ubuntu0.1 | The Ubuntu Pro builds for 16.04 to 20.04 are not public, so they are unchecked. | |
| R100 | Compiled 1.1 and later | Error string in the binary | _ERROR_FORMAT_BLOCK_SWITCH | Fixed builds only. | |
| R101 | Compiled 1.0.x | Error string in the binary | BLOCK_SWITCH | Fixed builds only. | |