{"id":"CVE-2020-36846","details":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","aliases":["BIT-brotli-2020-8927","BIT-dotnet-2020-8927","BIT-dotnet-sdk-2020-8927","BIT-powershell-2020-8927","CVE-2020-8927","GHSA-5v8v-66v8-mwm7","GO-2025-3726","PYSEC-2020-29","RUSTSEC-2021-0131","RUSTSEC-2021-0132"],"modified":"2026-04-10T04:27:15.795541Z","published":"2025-05-30T01:15:20.950Z","related":["openSUSE-SU-2025:15225-1"],"references":[{"type":"WEB","url":"https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8927"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5v8v-66v8-mwm7"},{"type":"FIX","url":"https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6"},{"type":"FIX","url":"https://github.com/google/brotli/pull/826"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/brotli","events":[{"introduced":"0"},{"fixed":"223d80cfbec8fd346e32906c732c8ede21f0cea6"}]}],"versions":["v0.1.0","v0.2.0","v0.3.0","v0.4.0","v0.6.0","v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36846.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}