How to update the Ubuntu brotli package for CVE-2026-111497 – cPanel

Question

CVE-2026-111497 affects Google Brotli. How do I update the Brotli packages on an Ubuntu server running cPanel & WHM, and does cPanel provide the fix?

Answer

CVE-2026-111497 is a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. A crafted Brotli-compressed stream can corrupt memory, disclose memory contents, cause a denial of service, or potentially allow arbitrary code execution. Upstream fixed it in Brotli 1.0.10, 1.1.1, and 1.2.1.

On Ubuntu, cPanel & WHM uses the operating system's brotli package, so the fix is delivered by Ubuntu through its regular package updates, not by a cPanel update. Ubuntu released the fix on October 26, 2026.

USN-8956-1

Ubuntu backports the fix into the existing upstream version, so the package version does not change to 1.1.1 or 1.2.1. Compare your installed version to the fixed Ubuntu package version for your release:

Ubuntu release	Fixed brotli package version
26.10	1.2.0-4ubuntu0.1
26.04 LTS	1.2.0-3ubuntu0.1
24.04 LTS	1.1.0-2ubuntu0.1
22.04 LTS	1.0.9-2ubuntu0.1

For Ubuntu 20.04 and earlier, check the Ubuntu CVE page for the current status.

Ubuntu CVE page

Check the installed version

Log in to the server as the root user via SSH.
List the installed Brotli packages:
```
dpkg -l | grep -i brotli
```
Compare the version column to the table above. If the installed version matches or is newer than the fixed version for your release, the server already has the fix. For example, 1.1.0-2ubuntu0.1 on Ubuntu 24.04 is the fixed version.

Update the packages

Update the package lists and upgrade the installed Brotli packages:
```
apt update
apt install --only-upgrade brotli libbrotli1 libbrotli-dev
```
Remove any package names from the command that are not installed on the server.
Confirm the fix is in the installed package's changelog:
```
apt changelog libbrotli1 | grep CVE-2026-111497
```
Restart services that load the Brotli library so they use the updated version. For example, to restart Apache:
```
/scripts/restartsrv_httpd
```
If the needrestart package is installed, run needrestart to list the services that need a restart.

Troubleshooting

If apt does not offer the updated package, run apt clean & apt update again and confirm the server can reach the Ubuntu security repositories.
If the installed version is lower than the fixed version in the table, the package has not been updated yet. Run the update steps above.

Node.js

The EasyApache 4 package ea-nodejs22 was updated to version 22.23.4 on October 21, 2026 to address CVE-2026-111497. See the EasyApache 4 change log. On Ubuntu 22.04 and later, the operating system's Node.js package uses the system brotli package, so updating Brotli as described above also covers it.

Additional resources