Critical Security Update for Brotli Package: Python Decompression Bomb Vulnerability
Summary
ALSA-2026:2389: Important: brotli security update. Affects brotli versions < 1.0.6-4.el8_10. Fixed in 1.0.6-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Brotli is a widely used lossless compression algorithm that combines modern variants of the LZ77 algorithm, Huffman coding, and second-order context modeling. It is known for its efficient compression ratios that rival the best general-purpose methods while maintaining speed comparable to deflate. This makes Brotli a popular choice for web applications and data transmission. However, recent vulnerabilities have raised concerns about its security, particularly in relation to Python implementations.
Vulnerability Detail
The vulnerability identified as CVE-2025-6176 pertains to a decompression bomb denial-of-service (DoS) attack within the Python implementation of Brotli. This vulnerability allows an attacker to craft a specially designed Brotli compressed file that, when decompressed, consumes excessive amounts of memory and CPU resources, potentially leading to service outages or degraded performance. The issue arises from the way Brotli handles decompression, making it susceptible to such attacks, which can be particularly damaging in production environments.
How To Fix
Minimum fixed version
1.0.6-4.el8_10
This is the first release that contains the fix.
sudo dnf update brotliTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the size of Brotli compressed files that can be processed by your application. This can help mitigate the risk of decompression bomb attacks until the packages are updated.
Conclusion
The Brotli package has a critical vulnerability that can lead to denial-of-service attacks through decompression bombs. It is crucial to update to the patched version to protect your applications. Implementing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for brotli →
FAQ
A decompression bomb is a maliciously crafted file that, when decompressed, expands to a size that can overwhelm system resources, leading to denial-of-service conditions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include service outages, degraded performance, and increased resource consumption, which can affect the overall user experience.
Implementing input validation and limiting the size of files that can be processed can help prevent exploitation until the packages are updated.
If immediate updates are not possible, consider applying workarounds such as input validation to mitigate risks until you can perform the updates.
Related vulnerabilities
Recent vulnerabilities recorded for brotli.
