CVE-2020-36846

crates.io/compu-brotli-sys CVE-2020-36846, CVE-2020-8927: medium 6.5

Integer overflow in the bundled Brotli C library

Action: Upgrade compu-brotli-sys to 1.0.9 or later.

cargo update -p compu-brotli-sys --precise 1.0.9

Affected

Fixed versions

Sources

• osv: GHSA-5v8v-66v8-mwm7
• https://nvd.nist.gov/vuln/detail/CVE-2020-8927
• https://github.com/bitemyapp/brotli2-rs/issues/45
• https://github.com/github/advisory-database/issues/785
• https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6
• https://www.debian.org/security/2020/dsa-4801
• https://usn.ubuntu.com/4568-1
• https://rustsec.org/advisories/RUSTSEC-2021-0132.html
• https://rustsec.org/advisories/RUSTSEC-2021-0131.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH
• https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html
• https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2020-29.yaml
• https://github.com/google/brotli/releases/tag/v1.0.9
• https://github.com/google/brotli/releases/tag/v1.0.8
• https://github.com/bitemyapp/brotli2-rs
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html

CVE-2020-36846, CVE-2020-8927 · published 2022-05-24T17:28:21Z · modified 2026-09-10T03:49:47.626305460Z · JSON

PyPI/brotli CVE-2020-36846, CVE-2020-8927: medium 6.5

Integer overflow in the bundled Brotli C library

Action: Upgrade brotli to 1.0.8 or later.

pip install brotli==1.0.8

Affected

Fixed versions

Sources

• osv: GHSA-5v8v-66v8-mwm7#PyPI/brotli
• https://nvd.nist.gov/vuln/detail/CVE-2020-8927
• https://github.com/bitemyapp/brotli2-rs/issues/45
• https://github.com/github/advisory-database/issues/785
• https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6
• https://www.debian.org/security/2020/dsa-4801
• https://usn.ubuntu.com/4568-1
• https://rustsec.org/advisories/RUSTSEC-2021-0132.html
• https://rustsec.org/advisories/RUSTSEC-2021-0131.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH
• https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html
• https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2020-29.yaml
• https://github.com/google/brotli/releases/tag/v1.0.9
• https://github.com/google/brotli/releases/tag/v1.0.8
• https://github.com/bitemyapp/brotli2-rs
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html

CVE-2020-36846, CVE-2020-8927 · published 2022-05-24T17:28:21Z · modified 2026-09-10T03:49:47.626305460Z · JSON

crates.io/brotli-sys CVE-2020-36846, CVE-2020-8927: unknown

Integer overflow in the bundled Brotli C library

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: RUSTSEC-2021-0131
• https://crates.io/crates/brotli-sys
• https://rustsec.org/advisories/RUSTSEC-2021-0131.html
• https://github.com/bitemyapp/brotli2-rs/issues/45
• https://github.com/google/brotli/releases/tag/v1.0.9

CVE-2020-36846, CVE-2020-8927 · published 2021-12-20T12:00:00Z · modified 2025-09-04T18:27:28.943295Z · JSON

crates.io/compu-brotli-sys CVE-2020-36846, CVE-2020-8927: unknown

Integer overflow in the bundled Brotli C library

Action: Upgrade compu-brotli-sys to 1.0.9 or later.

cargo update -p compu-brotli-sys --precise 1.0.9

Affected

Fixed versions

Sources

• osv: RUSTSEC-2021-0132
• https://crates.io/crates/compu-brotli-sys
• https://rustsec.org/advisories/RUSTSEC-2021-0132.html
• https://github.com/google/brotli/releases/tag/v1.0.9

CVE-2020-36846, CVE-2020-8927 · published 2021-12-20T12:00:00Z · modified 2025-10-28T06:02:18Z · JSON

Go/github.com/google/brotli CVE-2020-36846, CVE-2020-8927: unknown

IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2025-3726
• https://nvd.nist.gov/vuln/detail/CVE-2020-36846
• https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6
• https://github.com/google/brotli/pull/826
• https://github.com/advisories/GHSA-5v8v-66v8-mwm7
• https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52
• https://nvd.nist.gov/vuln/detail/CVE-2020-8927

CVE-2020-36846, CVE-2020-8927 · published 2025-06-03T17:57:59Z · modified 2026-03-03T04:56:39.449382Z · JSON

PyPI/brotli CVE-2020-36846, CVE-2020-8927: unknown

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happe

Action: Upgrade brotli to 1.0.8 or later.

pip install brotli==1.0.8

Affected

Fixed versions

Sources

• osv: PYSEC-2020-29
• https://github.com/google/brotli/releases/tag/v1.0.9
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/
• https://usn.ubuntu.com/4568-1/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/
• https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html
• https://www.debian.org/security/2020/dsa-4801
• https://github.com/advisories/GHSA-5v8v-66v8-mwm7

CVE-2020-36846, CVE-2020-8927 · published 2020-09-15T10:15:00Z · modified 2026-06-10T17:00:38.605765812Z · JSON