openSUSE Ships Python Brotli Fix for Actively Exploited Decoder Flaw
openSUSE has published openSUSE-SU-2026:22183-1, rated important, for the python-Brotli package on openSUSE Leap 16.0. It carries CVE-2026-111497, the Brotli decoder out-of-bounds write that permits remote code execution, scored 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0 by SUSE. The same update corrects a second issue, CVE-2025-6176, a denial-of-service weakness in Brotli decompression scored 7.5. Both flaws reach the Python ecosystem through the Brotli bindings that Leap 16.0 ships, and the advisory is the vendor's route to fixed packages for that release.
The vendor has not published exploitation details for either flaw, so no attack chain should be assumed beyond what the advisory states. What is documented is that the defect sits in the decompression path itself, meaning any service that feeds attacker-supplied Brotli-encoded data into the Python bindings is in scope. The fix moves the package to upstream version 1.2.1, released as python313-Brotli-1.2.1-160000.1.1, which among other changes allows the Python decoder's output to be limited — a direct response to the decompression abuse class. Two bug fixes ship alongside the two security corrections.
Brotli is embedded across web servers, HTTP clients, API frameworks and content pipelines, so the exposed surface is far wider than a single package name suggests. CVE-2026-111497 is confirmed exploited in the wild and was added to the CISA Known Exploited Vulnerabilities catalog on 27 October 2026, with FIRST EPSS placing the probability of exploitation in the next 30 days at 82.6 percent. CVE-2025-6176 shows no exploitation evidence and an EPSS probability of 0.5 percent. Unpatched Leap 16.0 hosts running Python workloads that decompress untrusted input remain reachable by activity already underway.
Attack Surface
Server OS, Web Application, Supply Chain (Third-party vendors)
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Install the openSUSE Leap 16.0 patch with 'zypper in -t patch openSUSE-Leap-16.0-2002=1', or apply it through YaST online_update, and confirm the installed package is python313-Brotli-1.2.1-160000.1.1 or later.
- Verify with 'rpm -q python313-Brotli' on every Leap 16.0 host; any version below 1.2.1-160000.1.1 remains vulnerable to CVE-2026-111497 and CVE-2025-6176.
- Prioritise remediation on hosts whose Python services decompress externally supplied Brotli data — HTTP clients, API gateways, log ingestion and content pipelines — because CVE-2026-111497 is KEV-listed and under active exploitation.
- Adopt the new decoder output limit exposed by Brotli 1.2.1's Python bindings in any application that decompresses untrusted input, which bounds the memory growth abused by the CVE-2025-6176 denial-of-service condition.
- Extend the inventory beyond the distribution package: search Leap 16.0 hosts, Python virtual environments and container base images for pip-installed Brotli wheels using 'pip list | grep -i brotli', since copies below upstream 1.2.1 are not replaced by openSUSE-SU-2026:22183-1.
- Alert on repeated segmentation faults, abnormal memory growth or worker restarts in Python processes handling Content-Encoding: br traffic, as these are the observable symptoms of both the out-of-bounds write and the decompression DoS.
- Restart or redeploy long-running Python services and containers after patching, since python313-Brotli is loaded into memory at process start and running workers will continue using the vulnerable extension.
