CVE-2020-8927
Buffer overflow in Brotli library
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 15, 2020
- Updated
- May 29, 2026
- Reserved
- Feb 12, 2020
Description
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Weaknesses
- CWE-130 Improper Handling of Length Parameter Inconsistency
Affected Products
| Product | Versions |
|---|---|
BrotliGoogle LLC |
|
References
- https://github.com/google/brotli/releases/tag/v1.0.9
- openSUSE-SU-2020:1578vendor-advisory
- FEDORA-2020-22d278923avendor-advisory
- USN-4568-1vendor-advisory
- FEDORA-2020-c663fbc46cvendor-advisory
- FEDORA-2020-e21bd401advendor-advisory
- FEDORA-2020-bc9a739f0cvendor-advisory
- FEDORA-2020-9336b65f82vendor-advisory
- FEDORA-2020-c76a35b209vendor-advisory
- [debian-lts-announce] 20201201 [SECURITY] [DLA 2476-1] brotli security updatemailing-list
- DSA-4801vendor-advisory
- FEDORA-2022-9e046f579avendor-advisory
- FEDORA-2022-5ecee47acbvendor-advisory
- FEDORA-2022-d28042f559vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.