PT-2020-5809 · Google+9 · Brotli Library+9
CVE-2020-8927
·
Published
2020-08-10
·
Updated
2025-11-25
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Brotli library versions prior to 1.0.8
Description:
A buffer overflow exists in the Brotli library where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. This issue can be exploited by a remote attacker to disrupt data integrity and cause a denial of service.
Recommendations:
To resolve the issue, update the Brotli library to 1.0.8 or later.
If updating is not possible, use the "streaming" API instead of the "one-shot" API and impose chunk size limits.
For Rust users, migrate to the
brotli crate, which provides a Rust implementation of Brotli compression and decompression that is not affected by this issue.Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Brotli Library
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu