Scalable Stories

Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli

Play Episode Pause Episode

1x

00:00 / 00:12:28

Apple Podcasts

RSS Feed

Share

Link

Embed

<blockquote class="wp-embedded-content" data-secret="nnWVpjelyo"><a href="https://www.getpagespeed.com/podcast/brotli-cve-2026-111497-audio">Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.getpagespeed.com/podcast/brotli-cve-2026-111497-audio/embed#?secret=nnWVpjelyo" width="500" height="350" title="&#8220;Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli&#8221; &#8212; GetPageSpeed" data-secret="nnWVpjelyo" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script> /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); //# sourceURL=https://www.getpagespeed.com/wp-includes/js/wp-embed.min.js </script>

Technical Briefing: CVE-2026-111497 (Brotli Decoder Flaw), Fixes by Distro and NGINX Impact

Today’s source is a new GetPageSpeed article on CVE-2026-111497, an out-of-bounds write in Google Brotli’s decoder. It explains which distributions ship fixes, how to patch servers stranded on end-of-life platforms (CentOS 7, Amazon Linux 2, older Debian/Ubuntu), and which NGINX packages are actually exposed. Commands, versions and caveats are as stated in the article.

The Problem

The vulnerability

The key point is that this is a decoder bug. Software that only compresses with Brotli does not reach the vulnerable code.

Why some servers are stranded

• CentOS 7: EPEL 7 is archived at the vulnerable libbrotli-1.0.9-10.el7 and will never be updated.
• Amazon Linux 2: Servers that took Brotli from EPEL are in the same position.
• Ubuntu 18.04/20.04 and Debian 10: These are officially fixed only through Ubuntu Pro and paid Freexian ELTS respectively.
• Ubuntu 16.04: This release is still fixed only through Ubuntu Pro. The article offers no alternative build for it.

The Implementation: Fixes by Platform

CentOS 7 and Amazon Linux 2 (x86_64, aarch64)

GetPageSpeed’s extras repository provides libbrotli 1.2.1:

yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum -y update libbrotli brotli
rpm -q libbrotli

• Expected output:
  • CentOS 7: libbrotli-1.2.1-5.el7.x86_64
  • Amazon Linux 2: libbrotli-1.2.1-5.amzn2.x86_64
• If the last command prints package libbrotli is not installed, nothing on the server uses the system Brotli library.
• Coverage: This one package fixes everything that links the system library, including NGINX, curl and OpenSSL.
• Restart required: Running processes keep the old library mapped until they restart, e.g. systemctl restart nginx.
• CentOS 7 side benefit: The first command also repoints the dead mirrorlist.centos.org entries to a maintained vault. This makes yum work again on servers where it had stopped.
• Compatibility: The package uses the same package split as Fedora/EPEL. On CentOS 7.9 it upgraded EPEL’s package in place with no conflicts.
• Licensing caveat: The package is free to install. Commercial production use requires a subscription.

RHEL, Rocky Linux and AlmaLinux 8–10

The vendor ships the fix:

dnf -y upgrade --refresh libbrotli brotli
rpm -q --changelog libbrotli brotli | grep CVE-2026-111497

Tested results:

• All three changelogs name the CVE.
• On EL8 with the GetPageSpeed repository enabled, the same command moves you to 1.2.1 instead, which is also fixed.

Debian and Ubuntu, supported releases

apt-get update
apt-get install --only-upgrade libbrotli1
dpkg-query -W libbrotli1

Ubuntu 18.04/20.04 and Debian 10 (amd64, arm64)

GetPageSpeed provides backported builds:

wget https://extras.getpagespeed.com/release-latest.deb
apt-get install ./release-latest.deb
apt-get update
apt-get install --only-upgrade libbrotli1
dpkg-query -W libbrotli1

• No relinking needed: The Brotli version and soname stay the same as stock, so nothing that links the library needs reinstalling.
• Restart long-running services afterwards.

Is NGINX Affected?

Stock NGINX does not link Brotli at all. Exposure depends on which modules and companion packages are installed:

• F5’s verdict (K000163902): The NGINX Plus Brotli module never decompresses and needs no update. F5 still advises updating the OS Brotli library for other programs on the server.
• ldd evidence on CentOS 7:
  • ngx_http_brotli_filter_module.so links only libbrotlienc and libbrotlicommon.
  • ngx_http_brotli_static_module.so links no Brotli library.
  • ngx_http_unbrotli_filter_module.so links libbrotlidec, the decoder.
  • No module bundles its own Brotli copy. The library update therefore fixes them without reinstalling NGINX. You only need to restart it.
• The module to watch is unbrotli. When a backend sends Content-Encoding: br, its body goes straight to the decoder. A compromised or hostile upstream can therefore reach the vulnerable code.
  • Once libbrotli is fixed, you can keep using the module as before (yum -y install nginx-module-unbrotli).
  • Licensing: without a subscription, a small license notice appears on HTML pages after 30 days.

Checking Exposure

1. Library version:

   rpm -q libbrotli brotli
   

   Anything from 1.0.3 to 1.2.0 without a vendor fix is vulnerable. This includes EPEL 7’s build.

2. Decoder consumers:

   rpm -q --whatrequires 'libbrotlidec.so.1()(64bit)'
   

   • On a CentOS 7 test box this listed brotli, openssl35-libs, libcurl-latest, curl-latest and nginx-module-unbrotli.
   • nginx-module-brotli was absent because it never touches the decoder.
   • Do not query the package name instead. rpm -q --whatrequires libbrotli prints no package requires libbrotli, because packages depend on sonames, not the package name.
3. Single binary or module:

   ldd /usr/lib64/nginx/modules/ngx_http_unbrotli_filter_module.so | grep brotli
   

   • A line pointing at /lib64/libbrotlidec.so.1 means the system library update covers it.
   • curl-latest --version shows brotli/1.2.1 once fixed.
4. Processes still on the old library:

   grep -l 'libbrotlidec.*(deleted)' /proc/[0-9]*/maps 2>/dev/null
   

   Each path printed belongs to a process that still needs a restart.

Python Bindings on CentOS 7

The libbrotli update does not cover the Python bindings. They compile Brotli into their own extension module. The old python-brotli and python34-brotli subpackages are still at 1.0.7.

• python-brotli: python2-brotli 1.2.1 obsoletes it, so yum update swaps it in automatically. The import then reports 1.2.1.
• python34-brotli: Since 1.2.1-3, python36-brotli obsoletes it. If rpm -q python34-brotli still shows 1.0.7 after updating, run:
  yum -y install python36-brotli
yum -y remove python34-brotli
• Warning: Do not run yum remove python-brotli on a fixed server. python2-brotli provides that name, so yum would remove the fixed package.

Caveats

• Blocking Content-Encoding: br in NGINX is not a substitute for patching.
  • F5’s interim advice for its own products is to reject such requests. That only helps where the server decompresses request bodies.
  • It does nothing for unbrotli, curl or OpenSSL, which receive Brotli data from the other side of the connection.
  • Update the library instead.
• Test environment: All commands were verified in clean x86_64 containers:
  • CentOS 7.9, starting from EPEL’s vulnerable build
  • Amazon Linux 2
  • AlmaLinux 8.10, 9.8 and 10.2
• Other stale packages: The article advises checking CentOS 7 boxes running PHP for “PHP2Shell” as well. That vulnerability was covered in the previous briefings on CentOS 6.

The Practical Payoff

• The fix belongs in the library, not NGINX. A single libbrotli update fixes every program that links the system decoder: NGINX’s unbrotli module, curl, and OpenSSL’s certificate decompression.
• Most servers need no reinstallation or relinking, only a service restart.
• Stranded platforms get a usable path:
  • CentOS 7 and Amazon Linux 2 get 1.2.1.
  • CentOS 7 also gets working yum mirrors.
  • Ubuntu 18.04/20.04 and Debian 10 get soname-compatible backports.
• The common ngx_brotli setup is not exposed. It is encoder-only and never touches the vulnerable code.

Bottom line: Update libbrotli (1.2.1 on CentOS 7/AL2, vendor packages elsewhere), handle the Python bindings separately on CentOS 7, then restart long-running services and confirm that none still map the deleted library.

Read the full article: Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli