PkgSeer

Vulnerability PYSEC-2020-29

Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 years ago
September 15, 2020 at 10:15 AM UTC
No summary available
0.5.2 - 1.0.7
0.5.2 - 1.0.7

Details

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown
8 days ago
Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
0.5.2 - 1.2.0 PYSEC-2026-4322
0.5.2 - 1.2.0 PYSEC-2026-4322
Critical
8 days ago
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
1.0.4 - 1.2.0 GHSA-9v8h-qqgm-4m35
1.0.4 - 1.2.0 GHSA-9v8h-qqgm-4m35
High Risk
3 months ago
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
0.5.2 - 1.1.0 PYSEC-2026-2401
0.5.2 - 1.1.0 PYSEC-2026-2401
High Risk
1 year ago
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
0.5.2 - 1.1.0 GHSA-2qfp-q593-8484
0.5.2 - 1.1.0 GHSA-2qfp-q593-8484
Medium Risk
4 years ago
Integer overflow in the bundled Brotli C library
0.5.2 - 1.0.7 GHSA-5v8v-66v8-mwm7
0.5.2 - 1.0.7 GHSA-5v8v-66v8-mwm7
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
6 years ago
September 15, 2020 at 10:15 AM UTC
Fixed (1.0.8)
6 years ago
August 27, 2020 at 11:22 AM UTC
Last Modified
4 months ago
June 10, 2026 at 05:00 PM UTC