Critical Security Update for Brotli: Addressing Python Decompression Bomb DoS Vulnerability
Summary
ALSA-2026:0845: Important: brotli security update. Affects brotli versions < 1.1.0-7.el10_1. Fixed in 1.1.0-7.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Brotli is a versatile lossless compression algorithm that combines a modern variant of the LZ77 algorithm, Huffman coding, and second-order context modeling. It is designed to compress data efficiently, achieving a compression ratio that rivals the best general-purpose methods available today. Brotli is widely used in various applications due to its speed and dense compression capabilities. However, a security vulnerability has been identified that could lead to denial-of-service (DoS) attacks when handling decompression tasks in Python.
Vulnerability Detail
The vulnerability, identified as CVE-2025-6176, pertains to a decompression bomb in the Python implementation of Brotli. This issue arises when an attacker crafts a specially designed compressed file that, when decompressed, consumes excessive system resources, potentially leading to service outages. The impact of this vulnerability can be severe, as it may allow an attacker to disrupt services by overwhelming the system with resource-intensive decompression tasks.
How To Fix
Minimum fixed version
1.1.0-7.el10_1
This is the first release that contains the fix.
sudo dnf update brotliTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on decompression tasks to mitigate the risk of DoS attacks. Additionally, avoid processing untrusted compressed files until the update is applied.
Conclusion
The Brotli compression algorithm has a critical vulnerability that can lead to denial-of-service attacks through decompression bombs. It is crucial to update the affected packages to the patched version to ensure system security. Implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for brotli →
FAQ
A decompression bomb is a maliciously crafted file that, when decompressed, expands to an extremely large size, consuming significant system resources and potentially causing a denial-of-service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary impact is a denial-of-service (DoS) attack, where an attacker can exploit the vulnerability to overwhelm the system, leading to service outages and degraded performance.
Yes, implementing rate limiting on decompression tasks can help mitigate the risk of DoS attacks until the update is applied.
For detailed information, including CVSS scores and acknowledgments, refer to the CVE page associated with CVE-2025-6176.
Related vulnerabilities
Recent vulnerabilities recorded for brotli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
