{"id":"CVE-2020-36846","published":"2025-05-30T00:50:28Z","modified":"2025-05-30T22:01:41Z","title":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library","vendor":"TIMLEGGE","product":"IO::Compress::Brotli","tier":"tail","description":{"text":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00661,"percentile":0.51512,"provenance":"source"},"cwes":[{"id":"CWE-1395","name":"Dependency on Vulnerable Third-Party Component"}],"references":[{"url":"https://github.com/google/brotli/pull/826","tags":["issue-tracking"]},{"url":"https://github.com/advisories/GHSA-5v8v-66v8-mwm7","tags":["third-party-advisory"]},{"url":"https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52","tags":["mitigation"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8927","tags":["vdb-entry"]},{"url":"https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6","tags":["patch"]}],"priority":{"score":17.2,"factors":[{"name":"EPSS percentile","points":10.3},{"name":"CVSS severity","points":6.86}]},"vendorSlug":"timlegge","affectedVersions":[{"vendor":"TIMLEGGE","product":"IO::Compress::Brotli","versions":["< 0.007"]}],"affected":[{"ecosystem":"PyPI","package":"brotli","vulnerableRanges":["<1.0.8"],"patched":["1.0.8"],"from":["PYSEC-2020-29"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/google/brotli","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2025-3726"],"provenance":"source"},{"ecosystem":"crates.io","package":"brotli-sys","vulnerableRanges":[">=0.0.0-0"],"patched":[],"from":["RUSTSEC-2021-0131"],"provenance":"source"},{"ecosystem":"crates.io","package":"compu-brotli-sys","vulnerableRanges":[">=0.0.0-0, <1.0.9"],"patched":["1.0.9"],"from":["RUSTSEC-2021-0132"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-16444","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-timlegge-io-compress-brotli-cve-2020-36846","children":[{"from":"CVE-2020-36846","to":"CVE-2026-111497","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["c/dec/decode.c"],"commits":["https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6","https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b","https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-36846","published":"2025-05-30","fixed":"1.0.8","kev":false},{"cve":"CVE-2025-6176","published":"2025-10-31","fixed":"1.2.0","kev":false,"link":{"from":"CVE-2020-36846","to":"CVE-2025-6176","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:brotli","fromFixed":"1.0.8","toFixed":"1.2.0","daysApart":154}]}},{"cve":"CVE-2026-111497","published":"2026-10-22","fixed":"1.2.1","kev":true}],"package":"PyPI:brotli"}}