CVE-2020-36846
IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library
- State
- Published
- Severity
- 9.8 Critical
- Published
- May 30, 2025
- Updated
- May 30, 2025
- Reserved
- May 28, 2025
Description
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-1395 Dependency on Vulnerable Third-Party Component
Affected Products
| Product | Versions |
|---|---|
IO::Compress::BrotliTIMLEGGE |
|
References
- https://github.com/google/brotli/pull/826issue-tracking
- https://github.com/advisories/GHSA-5v8v-66v8-mwm7third-party-advisory
- https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52mitigation
- https://nvd.nist.gov/vuln/detail/CVE-2020-8927vdb-entry
- https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.