PT-2025-23219 · Unknown · Io::Compress::Brotli

Robert Rothenberg · Published 2020-09-15 · Updated 2025-09-04 · CVE-2020-36846

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IO::Compress::Brotli versions prior to 0.007

Description A buffer overflow exists in the embedded Brotli library. An attacker controlling the input length of a decompression request can trigger a crash when copying over chunks of data larger than 2 GiB.

Recommendations Update the IO::Compress::Brotli module to version 0.007 or later. If an update is not possible, use the streaming API instead of the one-shot API and impose chunk size limits.

Fix

Buffer Overflow

Weakness Enumeration

CWE-1395

CWE-120

Related Identifiers

BIT-BROTLI-2020-8927

BIT-DOTNET-2020-8927

BIT-DOTNET-SDK-2020-8927

BIT-POWERSHELL-2020-8927

CVE-2020-36846

GHSA-5V8V-66V8-MWM7

GO-2025-3726

OPENSUSE-SU-2025:15225-1

PYSEC-2020-29

RUSTSEC-2021-0131

RUSTSEC-2021-0132

Affected Products

Io::Compress::Brotli

References · 85

• https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8927 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-2020-8927 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-29 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK · Vendor Advisory
• https://debian.org/security/2020/dsa-4801 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36846 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3726 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH · Vendor Advisory