PkgSeer

Vulnerability GHSA-9v8h-qqgm-4m35

Critical

8 days ago

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

1.0.4 - 1.2.0

Summary

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

Details

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

0.5.2 - 1.2.0 PYSEC-2026-4322

Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

0.8.0 - 1.2.0.2 PYSEC-2026-4323

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

0.5.2 - 1.1.0 PYSEC-2026-2401

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

0.5.2 - 1.1.0 GHSA-2qfp-q593-8484

Integer overflow in the bundled Brotli C library

0.5.2 - 1.0.7 GHSA-5v8v-66v8-mwm7

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

8 days ago

Fixed (1.2.1)

8 days ago

Fixed (1.2.1.0)

8 days ago

Last Modified

1 day ago