starred/brotli
1
0
Fork 0
mirror of https://github.com/google/brotli.git synced 2026-09-23 07:05:31 +00:00
Code Issues 1.2k Packages Projects Releases 20 Wiki Activity

Can upstream help to backport CVE-2025-6176 fix for 1.0.9 release? #569

New Issue
Open
opened 2026-01-29 20:45:55 +00:00 by claunia · 2 comments
claunia commented 2026-01-29 20:45:55 +00:00
Owner
Copy Link

Originally created by @pnemade on GitHub (Jan 5, 2026).

Hi,
I see that brotli-1.0.9 is C++ code and later releases are pure C code.
We saw CVE-2025-6176 fix in 1.2.0 release but there are still many linux distributions which are using brotli-1.0.9 release.
Is it possible for upstream to provide this CVE fix patch release for brotli-1.0.9 ?

Originally created by @pnemade on GitHub (Jan 5, 2026). Hi, I see that brotli-1.0.9 is C++ code and later releases are pure C code. We saw CVE-2025-6176 [fix](https://github.com/google/brotli/pull/1234/files) in 1.2.0 release but there are still many linux [distributions](https://repology.org/project/brotli/versions) which are using brotli-1.0.9 release. Is it possible for upstream to provide this CVE fix patch release for brotli-1.0.9 ?
claunia commented 2026-01-29 20:45:55 +00:00
Author
Owner
Copy Link

@pnemade commented on GitHub (Jan 8, 2026):

@robryk can you help?

@pnemade commented on GitHub (Jan 8, 2026): @robryk can you help?
claunia commented 2026-01-29 20:45:55 +00:00
Author
Owner
Copy Link

@Dreamsorcerer commented on GitHub (Jan 13, 2026):

Note that the fix changes the API to add a new parameter that developers can use to limit the output (e.g. https://github.com/aio-libs/aiohttp/pull/11898). You would need to update all dependents to use that new API in order to resolve any security issues, at which point maybe it's easier to just update the dependency for them to 1.2...

Backporting the fix to brotli and then not updating any other projects would resolve nothing.

@Dreamsorcerer commented on GitHub (Jan 13, 2026): Note that the fix changes the API to add a new parameter that developers can use to limit the output (e.g. https://github.com/aio-libs/aiohttp/pull/11898). You would need to update all dependents to use that new API in order to resolve any security issues, at which point maybe it's easier to just update the dependency for them to 1.2... Backporting the fix to brotli and then not updating any other projects would resolve nothing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
feature
help wanted
pull-request
Mirrored from GitHub Pull Request
 release-v1.1
release-v1.1.1
release-v1.2
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/brotli#569
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?