Get real-time updates on Telegram
ghsa:GHSA-9V8H-QQGM-4M35: brotli >= 1.0.3, < 1.2.1; +1 more affected products
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package. Affected range: >= 1.0.3, < 1.2.1. Fixed version: 1.2.1. Affected range: >= 1.0.3, < 1.2.1.0. Fixed version: 1.2.1.0.
Affected technology
brotli · >= 1.0.3, < 1.2.1
Vendor not specified by the source
brotlicffi · >= 1.0.3, < 1.2.1.0
Vendor not specified by the source
Component: Not specified by the source
What an attacker can do
A remote unauthenticated attacker can corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- Product
- brotli
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC
Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-9v8h-qqgm-4m35.html