On this page (7 sections)

On 27 October 2026 Ubuntu published USN-8956-2, which brings a fix for a Brotli vulnerability to Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS. It follows USN-8956-1, published a day earlier for newer releases.

If you run web servers, build hosts or containers on one of these older Ubuntu releases and they handle compressed data from outside, this update is for you. The fixed packages for these releases are delivered through Ubuntu Pro.

What Ubuntu says happened

Ubuntu's notice says Brotli incorrectly handled certain compressed streams. In its words, a remote attacker could possibly use this to cause a denial of service or execute arbitrary code. The overview says Brotli could be made to crash or run programs if it received specially crafted input.

The notice gives no further technical detail, no CVSS score and no statement about exploitation in the wild. Treat the exploitation status as unknown rather than as safe. The only reference is CVE-2026-111497.

Why compressed-data bugs matter

Brotli is a lossless compression format. Programs that decompress data have to parse input they did not create, and that input may come from a remote party. When a decoder mishandles a malformed stream, the usual outcomes are a crash (denial of service) or, in worse cases, memory corruption that can lead to code execution. Ubuntu lists both as possibilities here, with the wording 'possibly'.

Practical exposure depends on what on your system links to the library. Web servers, proxies, HTTP clients and Python applications may all use it. The affected package list includes the command line utility, the shared library and the Python bindings, so check more than the brotli command itself.

Which Ubuntu releases and packages are affected

This notice covers the extended-support releases. The related notice USN-8956-1 covers 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10.

Fixed Brotli package versions per Ubuntu release (from the Ubuntu notices)
ReleaseNoticeFixed versionPackages
16.04 LTS (xenial)USN-8956-21.0.3-1ubuntu1~16.04.2+esm1brotli, libbrotli1, python-brotli, python3-brotli
18.04 LTS (bionic)USN-8956-21.0.3-1ubuntu1.3+esm1brotli, libbrotli1, python-brotli, python3-brotli
20.04 LTS (focal)USN-8956-21.0.7-6ubuntu0.1+esm1brotli, libbrotli1, python3-brotli
22.04 LTS (jammy)USN-8956-11.0.9-2ubuntu0.1brotli, libbrotli1, python3-brotli
24.04 LTS (noble)USN-8956-11.1.0-2ubuntu0.1brotli, libbrotli1, python3-brotli
26.04 LTS (resolute)USN-8956-11.2.0-3ubuntu0.1brotli, libbrotli1, python3-brotli
26.10 (stonking)USN-8956-11.2.0-4ubuntu0.1brotli, libbrotli1, python3-brotli
The 16.04, 18.04 and 20.04 fixes are marked 'Fix available with Ubuntu Pro'. For 16.04 LTS, Ubuntu says it is available via the Legacy Support add-on. Without Ubuntu Pro enabled, a standard update will not offer these versions.

How to check your exposure

This read-only command lists the installed Brotli-related packages and their versions on Debian-based systems such as Ubuntu. Compare the version column with the table above.

List installed Brotli packages and versions (Ubuntu)Shell
dpkg -l | grep -i brotli

This command shows the installed and candidate versions for the library package, so you can see whether a fixed version is available to your system.

Show installed vs. candidate version of libbrotli1 (Ubuntu)Shell
apt-cache policy libbrotli1

To confirm which release you run, print the release information. Look for 16.04, 18.04 or 20.04 in the output.

Show the Ubuntu release (run on the server)Shell
lsb_release -a

What to do now

Ubuntu states that in general a standard system update makes all the necessary changes. For the older releases, the fixed versions come through Ubuntu Pro, which Ubuntu says is free for up to five machines.

Caution. Updating shared libraries can affect running services. Schedule the update for a maintenance window and test on a staging machine first, especially on production web servers.

This updates package lists and then upgrades only the Brotli packages on Ubuntu, once Ubuntu Pro is attached for 16.04, 18.04 or 20.04. Afterward, re-run the version check above and confirm the +esm1 versions.

Update only the Brotli packages (Ubuntu, run as root or with sudo)Shell
sudo apt update
sudo apt install --only-upgrade brotli libbrotli1 python3-brotli

On 16.04 LTS and 18.04 LTS the python-brotli package is also listed, so include it if it is installed.

Tip. Applications that are already running keep the old library in memory until restarted. Ubuntu's notice for this issue does not list a service restart, but restarting services that rely on Brotli is a sensible precaution.

Monitoring afterwards

Since the exploitation status is not stated, watch for symptoms that a decoder bug can cause: unexplained crashes or restarts of web servers and application workers, and error messages mentioning decompression in your logs. Keep a record of package versions per host so the next advisory is a quick lookup.

For a view from outside, a Webforta Scan of your verified sites can show what your public endpoints expose, and uptime monitoring can alert you if a service starts crashing. Neither replaces patching the library itself. For related Ubuntu library fixes this week, see our note on nginx heap overflow flaws in USN-8955-1.

Timeline

  • 22 October 2026: Ubuntu publishes notices for zlib (USN-8954-1) and OpenVPN (USN-8953-1), separate issues from this one.
  • 26 October 2026: USN-8956-1 fixes Brotli on Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10.
  • 27 October 2026: USN-8956-2 extends the fix to Ubuntu 16.04, 18.04 and 20.04 LTS through Ubuntu Pro.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. USN-8956-2: Brotli vulnerability | Ubuntu security notices | Ubuntuubuntu.com ·
  2. USN-8956-1: Brotli vulnerability | Ubuntu security notices | Ubuntuubuntu.com ·
  • Ubuntu
  • Brotli
  • USN
  • Patching
  • Ubuntu Pro
  • Linux servers