{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/google/brotli","cve_ids":["CVE-2020-36846","CVE-2020-8927"],"ecosystem":"Go","epss":0.00633,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5v8v-66v8-mwm7","id":"tcs_01M5KG8RC0JFGSMA6DKXRAG6W7","modified_at":"2026-03-03T04:56:39.449382Z","published_at":"2025-06-03T17:57:59Z","references":["https://osv.dev/vulnerability/GO-2025-3726","https://nvd.nist.gov/vuln/detail/CVE-2020-36846","https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6","https://github.com/google/brotli/pull/826","https://github.com/advisories/GHSA-5v8v-66v8-mwm7","https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52","https://nvd.nist.gov/vuln/detail/CVE-2020-8927"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2025-3726","url":"https://osv.dev/vulnerability/GO-2025-3726"}],"summary":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli"}