[C++] We should take a newer version of Brotli #55165

Activity

1. CurtHagenlocher

   added

   Type: bug

   on Oct 23, 2026
2. github-actions

   added

   Component: C++

   on Oct 23, 2026
3. github-actions

   assigned

   CurtHagenlocher

   on Oct 23, 2026
4. Buedenbender commented on Oct 27, 2026

   

   Buedenbender

   on Oct 27, 2026

   More actions

   The mentioned good reason:

   • https://www.cve.org/CVERecord?id=CVE-2026-111497
   • https://nvd.nist.gov/vuln/detail/cve-2026-111497

   👍React with 👍1Reacted by Timo Voipio
5. kou

   marked [C++] Bundled Brotli 1.0.9 is affected by CVE-2026-111497 (decoder out-of-bounds write) #55166 as a duplicate of this issue on Oct 27, 2026
6. tvoipio commented on Oct 27, 2026

   

   tvoipio

   on Oct 27, 2026

   More actions

   Could the (Py)Arrow team please indicate which distributions/versions of PyArrow are affected? I tried to figure this out and it seems that the PyPI distribution (https://pypi.org/project/pyarrow/) includes statically linked brotli v1.0.9 as discussed here and in the linked issue + PR, but the conda-forge distributed pyarrow uses dynamically linked version, maybe from libbrotlicommon. At least installing pyarrow from conda-forge pulls in libbrotlicommon, libbrottlidec, libbrotlienc.