Ubuntu backports Brotli stream-handling fix to older LTS releases
First merged summary.
Ubuntu’s USN-8956-2 backports a Brotli compressed-stream fix to 16.04, 18.04 and 20.04 LTS; no CVE is named.
Ubuntu published USN-8956-1 on October 26, 2026, warning that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use the issue to cause a denial of service or execute arbitrary code. On October 27, USN-8956-2 supplied those fixes for Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS. Neither notice names a CVE, a fixed package version, or whether the flaw is being exploited.
- Brotli incorrectly handled certain compressed streams, Ubuntu says.
- A remote attacker could possibly cause denial of service or code execution.
- USN-8956-1 contained the original Brotli fix.
- USN-8956-2 covers Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS.
- Neither notice names a CVE, fixed package version, or exploitation status.
Timeline
dated events in the reporting · oldest first- Oct 26, 2026USN-8956-1 warns of a Brotli compressed-stream flaw · Ubuntu Security Notices
- Oct 27, 2026USN-8956-2 backports the fix to three older LTS releases · Ubuntu Security Notices
What each outlet adds
beyond the shared facts- Ubuntu Security Notices (USN-8956-1)Original notice of the Brotli stream-handling flaw and impact.
- Ubuntu Security Notices (USN-8956-2)Backport scope: Ubuntu 16.04, 18.04 and 20.04 LTS.
Coverage
oldest first · one row per article · UTC- · 4d ago
Ubuntu Security NoticesFirst report
Ubuntu: Brotli mishandles streams, enabling possible DoS or code execution
USN-8956-1 says a remote attacker could abuse malformed compressed streams; no CVE, versions, or exploitation status are given.
- · 3d ago
Ubuntu patches Brotli bug that could crash systems or run code
USN-8956-2 backports the earlier Brotli fix to Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS, with no CVE named.