> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ubuntu USN-8956-2 brings the Brotli fix to older LTS releases
- URL: https://stackurity.ai/blog/ubuntu-usn-8956-2-brotli-older-lts-releases/
- Published: 2026-10-29T05:35:05.000Z
- Updated: 2026-10-30T12:23:04.000Z
- Description: Ubuntu notice USN-8956-2 extends the Brotli fix to older LTS releases. See who is affected and how to check a server.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** Ubuntu notice USN-8956-2 brings the Brotli security fix to the older 16.04 LTS, 18.04 LTS and 20.04 LTS releases. Update the package if you run any of them.

## What happened

Ubuntu published [USN-8956-2](https://ubuntu.com/security/notices/USN-8956-2), a follow-up to USN-8956-1\. The first notice fixed a Brotli problem on newer releases, and this one carries the same fix to Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS. Ubuntu says Brotli mishandled some compressed streams, so a remote attacker could cause a crash or possibly run code. It concerns the same library as the exploited flaw in [our Brotli post](https://stackurity.ai/blog/brotli-cve-2026-111497-exploited-decoder-flaw/), though the notice does not name a CVE that we can cite here.

The package version to install is not in our data, so read the notice for it.

## Am I affected?

You are if a server or image runs one of those releases and has Brotli installed, directly or as a dependency of a web server or library. Check on one machine:

```
lsb_release -ds
dpkg -l | grep -i brotli
apt list --upgradable 2>/dev/null | grep -i brotli
```

Programs that ship their own bundled Brotli copy will not be fixed by the package update.

## How to check with Stackurity

Stackurity's read-only agent reads installed packages on Ubuntu and other Linux servers and matches them against vendor advisories every hour, accounting for backports. Libraries copied into an application outside a package manager are not covered. See [how verification works](https://stackurity.ai/docs/verification) and [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=ubuntu-usn-8956-2-brotli-older-lts-releases).