IO::Compress::Brotli before 0.023 has decoder out-of-bounds write
Original title: CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder
Perl module versions from 0.004001 before 0.023 ship a brotli library whose decoder can write out of bounds (CVE-2026-115936).
Timothy Legge posted to oss-security on October 23 about CVE-2026-115936 in the Perl distribution IO::Compress::Brotli. Versions from 0.004001 before 0.023 bundle a brotli library with an out-of-bounds write in the decoder. The feed text stops after the MetaCPAN link, so exploitability and a named release are not shown.
Unconfirmed: The mailing-list body is truncated, so exploitation and the exact fix announcement are not shown.
- Affected range stated as 0.004001 before 0.023.
- The flaw is an out-of-bounds write in the bundled brotli decoder.
- The note was posted by Timothy Legge on October 23.
Impact: Out-of-bounds write in the bundled brotli decoder
| Product | Affected | Fixed in |
|---|---|---|
| IO::Compress::Brotli | 0.004001 before 0.023 | 0.023 |
- 1.Upgrade IO::Compress::Brotli to 0.023 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115936 | — | — | — |
From the original article
Posted by Timothy Legge on Oct 23 ======================================================================== https://metacpan. org/dist/IO-Compress-Brotli VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.