XS::libbrotli before 1.2.1.0 vulnerable to out-of-bounds write (CVE-2026-115946)
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with decoder out-of-bounds write vulnerability.
35
CVE-2026-115946
OOB write in XS::libbrotli bundled brotli before 1.2.1.0
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
XS::libbrotli versions before 1.2.1.0 bundle brotli 1.0.7 or 1.1.0 containing a decoder OOB write (CVE-2026-111497). Any dependent XS module decompressing untrusted brotli data triggers it via the bundled library. An attacker can corrupt decoder state, disclose memory, crash the process, or execute arbitrary code.
What to do: Upgrade XS::libbrotli to 1.2.1.0
| Product | Affected | Fixed in |
|---|---|---|
| XS::libbrotli | before 1.2.1.0 | 1.2.1.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.