Actively Exploited Brotli Decoder Flaw Prompts New openSUSE Update for Python Brotli
A security update has been published for the python-Brotli package shipped in openSUSE Leap 16.1, addressing a decoder defect that carries a remote code execution risk. openSUSE has released advisory openSUSE-SU-2026:22312-1, rated important, for python-Brotli on openSUSE Leap 16.1. It addresses CVE-2026-111497, an out-of-bounds write in the Brotli decoder that permits remote code execution. SUSE scores the flaw 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0, and tracks it internally as bsc#1287779. Any Leap 16.1 host running python313-Brotli below version 1.2.1 is affected.
The vendor has not published exploitation details beyond the nature of the defect: an out-of-bounds write reached through the Brotli decompression routine. Brotli decoding is typically triggered by untrusted input, which is consistent with the network attack vector in both published CVSS strings and the absence of any privilege or user-interaction requirement. The fix is a version bump rather than a backported patch, updating python-Brotli to upstream release 1.2.1. The corrected package is python313-Brotli-1.2.1-160100.1.1, delivered through patch openSUSE-Leap-16.1-7=1.
This update deserves different handling from a routine Leap patch cycle. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October 2026, confirming exploitation in the wild rather than theoretical risk, and FIRST places the probability of exploitation in the next thirty days at 82.6 percent. Brotli is a widely embedded compression library, so exposure extends beyond obvious web servers; any Python service that decompresses attacker-supplied Brotli data on an unpatched Leap 16.1 host carries a remote code execution risk while the older package remains installed.
Attack Surface
Server OS, Web Application, Supply Chain (Third-party vendors)
Tactics
Initial Access, Execution
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Apply the openSUSE Leap 16.1 patch with 'zypper in -t patch openSUSE-Leap-16.1-7=1' (or YaST online_update) and verify that python313-Brotli-1.2.1-160100.1.1 is installed, which is the build that fixes CVE-2026-111497.
- Inventory every Leap 16.1 host with 'rpm -q python313-Brotli' and flag any result earlier than 1.2.1-160100.1.1 as unpatched against bsc#1287779.
- Refresh the openSUSE Leap 16.1 update repositories with 'zypper ref' before installing, so the python313-Brotli-1.2.1-160100.1.1 build shipped in openSUSE-SU-2026:22312-1 is visible to zypper and YaST online_update.
- Scope the affected estate against the product list in openSUSE-SU-2026:22312-1, which names only openSUSE Leap 16.1 – confirm any other SUSE or Leap release through the SUSE CVE page for CVE-2026-111497 before recording it as unaffected.
- Rank the openSUSE-SU-2026:22312-1 patch ahead of the routine Leap 16.1 maintenance window, as CISA listed CVE-2026-111497 in its Known Exploited Vulnerabilities catalogue on 27 October 2026 and FIRST EPSS puts the thirty-day exploitation probability at 82.6 percent.
- Confirm completion on each Leap 16.1 host by checking that patch openSUSE-Leap-16.1-7=1 no longer appears as needed in 'zypper list-patches', which indicates the python313-Brotli update from openSUSE-SU-2026:22312-1 has been applied.
- Subscribe to the SUSE CVE page for CVE-2026-111497 and the bsc#1287779 bug record to pick up fixes for other Python stack branches or products beyond Leap 16.1.
