{"id":"GO-2026-6888","summary":"Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli","details":"In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service.","aliases":["BIT-brotli-2026-111497","BIT-dotnet-2026-111497","BIT-dotnet-sdk-2026-111497","BIT-node-2026-111497","BIT-node-min-2026-111497","BIT-powershell-2026-111497","CVE-2026-111497","GHSA-9v8h-qqgm-4m35","GHSA-c9gr-gmg4-2vqv","PYSEC-2026-4322","PYSEC-2026-4323"],"modified":"2026-11-05T23:25:49.434824566Z","published":"2026-11-05T22:55:15Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6888","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv"},{"type":"FIX","url":"https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42"},{"type":"WEB","url":"https://github.com/andybalholm/brotli/releases/tag/v1.2.7"},{"type":"WEB","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"}],"affected":[{"package":{"name":"github.com/andybalholm/brotli","ecosystem":"Go","purl":"pkg:golang/github.com/andybalholm/brotli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}],"ecosystem_specific":{"imports":[{"symbols":["Reader.Read","decodeBlockTypeAndLength","decodeCommandBlockSwitch","decodeCommandBlockSwitchInternal","decodeDistanceBlockSwitch","decodeDistanceBlockSwitchInternal","decodeError.Error","decodeLiteralBlockSwitch","decodeLiteralBlockSwitchInternal","decoderErrorString","processCommandsInternal","safeDecodeCommandBlockSwitch","safeDecodeDistanceBlockSwitch","safeDecodeLiteralBlockSwitch"],"path":"github.com/andybalholm/brotli"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6888.json"}}],"schema_version":"1.9.2","credits":[{"name":"Philippe Antoine (Catena cyber)"}]}