From b6a16ac82aa052425d2cffda70ab6cc2c3cd7987 Mon Sep 17 00:00:00 2001 From: Rodrigo Toshiaki Horie Date: Tue, 27 Oct 2026 14:48:47 -0300 Subject: [PATCH] Bump Brotli to address CVE-2026-111497 (#16759) CVE-2026-111497 - Bump Brotli to 1.2.1 Add Brotli>=1.2.1 pin to requirements.in to address CVE-2026-111497 (Out-of-Bounds Write in Google Brotli Decoder). Regenerated requirements.txt via make docker_update_requirements. Co-authored-by: Claude Sonnet 4.6 Co-authored-by: Jake Jackson <24478650+thedoubl3j@users.noreply.github.com> --- requirements/requirements.in | 1 + requirements/requirements.txt | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/requirements/requirements.in b/requirements/requirements.in index e8a5276269..a67cc347b2 100644 --- a/requirements/requirements.in +++ b/requirements/requirements.in @@ -6,6 +6,7 @@ azure-identity azure-keyvault boto3 botocore +Brotli>=1.2.1 # CVE-2026-111497, required by aiohttp[speedups] cachetools # Used by awx/conf/settings.py for TTLCache channels channels-redis diff --git a/requirements/requirements.txt b/requirements/requirements.txt index 777987f938..5ec066bdae 100644 --- a/requirements/requirements.txt +++ b/requirements/requirements.txt @@ -76,8 +76,10 @@ botocore==1.40.46 # -r /awx_devel/requirements/requirements.in # boto3 # s3transfer -brotli==1.2.0 - # via aiohttp +brotli==1.2.1 + # via + # -r /awx_devel/requirements/requirements.in + # aiohttp cachetools==6.2.0 # via -r /awx_devel/requirements/requirements.in # certifi @ git+https://github.com/ansible/system-certifi.git@devel # git requirements installed separately