CVE-2026-111497 Brotli out-of-bounds write

[jmaegn]

The update to resolve CVE-2026-111497 (#10340) is in the main branch already. Is there a release planned for sooner than the next quarterly (2027-01) so this can be incorporated into downstream projects?

[aclark4life]

No, but it could certainly be discussed. @hugovk thoughts ?

[hugovk]

First I'd like to understand the actual exposure to Pillow.

At least we've not had any PoC reports or repros, afaik only responses to CVE scanner tools.