QSN-8956-1: Brotli vulnerability
2026-10-26

Summary:
Brotli could be made to crash or run programs if it received specially
crafted input.

Details:
It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.

Affected QuantaStor releases:
  6.9.1.001 jammy: libbrotli1 1.0.9-2ubuntu0.1 (fixed in 1.0.9-2ubuntu0.1)
  6.9.1.001 jammy: python3-brotli 1.0.9-2ubuntu0.1 (fixed in 1.0.9-2ubuntu0.1)
  6.9.0.464 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.9.0.464 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.6.015 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.6.015 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.5.018 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.5.018 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.4.038 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.4.038 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.3.018 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.3.018 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.2.002 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.2.002 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.1.007 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.1.007 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.0.205 jammy: libbrotli1 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)
  6.8.0.205 jammy: python3-brotli 1.0.9-2build6 (fixed in 1.0.9-2ubuntu0.1)

CVEs: CVE-2026-111497

References:
  https://ubuntu.com/security/notices/USN-8956-1