mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-10 07:47:06 +00:00
Giteabot
e847d6a9c6
Backport #40246 by @GiteaBot This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/andybalholm/brotli](https://redirect.github.com/andybalholm/brotli) | `v1.2.1` → `v1.2.7` |  |  | --- ### Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli BIT-brotli-2026-111497 / BIT-dotnet-2026-111497 / BIT-dotnet-sdk-2026-111497 / BIT-node-2026-111497 / BIT-node-min-2026-111497 / BIT-powershell-2026-111497 / [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) / [GHSA-9v8h-qqgm-4m35](https://redirect.github.com/advisories/GHSA-9v8h-qqgm-4m35) / [GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/advisories/GHSA-c9gr-gmg4-2vqv) / [GO-2026-6888](https://pkg.go.dev/vuln/GO-2026-6888) / PYSEC-2026-4322 / PYSEC-2026-4323 <details> <summary>More information</summary> #### Details In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service. #### Severity Unknown #### References - [https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv) - [https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42](https://redirect.github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42) - [https://github.com/andybalholm/brotli/releases/tag/v1.2.7](https://redirect.github.com/andybalholm/brotli/releases/tag/v1.2.7) - [https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b](https://redirect.github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6888) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>andybalholm/brotli (github.com/andybalholm/brotli)</summary> ### [`v1.2.7`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.6...v1.2.7) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.6...v1.2.7) ### [`v1.2.6`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.5...v1.2.6) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.5...v1.2.6) ### [`v1.2.5`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.4...v1.2.5) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.4...v1.2.5) ### [`v1.2.4`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.3...v1.2.4) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.3...v1.2.4) ### [`v1.2.3`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.2...v1.2.3) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.2...v1.2.3) ### [`v1.2.2`](https://redirect.github.com/andybalholm/brotli/compare/v1.2.1...v1.2.2) [Compare Source](https://redirect.github.com/andybalholm/brotli/compare/v1.2.1...v1.2.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xOTAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE5MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
