p PatchFirst

PatchFirst · Latest vulnerabilities

brotli vulnerabilities

Vulnerabilities published for brotli in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-111497

    Critical · CVSS 9.2EPSS 0.71%Public exploitFix available

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

    brotli brotliPython
    • Update to 1.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2025-6176

    High · CVSS 7.5EPSS 0.55%Fix available

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

    brotliPython
    • Update to 1.2.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2020-36846

    Critical · CVSS 9.8EPSS 0.63%Fix available

    IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

    A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

    brotliPython
    • Update to 1.0.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →