English German
Breadcrumbs

ISN 2026-43: Critical Brotli Issue in IGEL OS

First published 2 November 2026 (Pre-Notification)

CVSS:3.1: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A security vulnerability has been found in Brotli, an open-source compression library used in IGEL OS. This affects the following product versions:

  • IGEL OS 12

  • IGEL OS 11

Details

A buffer overflow has been discovered in the Brotli decoder. As it is used in network software, a remote attacker could use a crafted Brotli-compressed stream to corrupt memory, disclose sensitive memory contents, crash the program or potentially execute arbitrary code.

Update Instructions

  • OS 12: Upgrade the Base System app to version 12.10.1 PR 1 or to 12.8.4 LTS PR 3 as soon as they are available on the IGEL APP Portal.

  • OS 11: IGEL OS 11 reached End of Maintenance in June 2026. To ensure continued access to security updates and support, we recommend migrating to IGEL OS 12.

References