CVE-2020-36846: IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library
Modified
AliasesGHSA-5v8v-66v8-mwm7BIT-brotli-2020-8927BIT-dotnet-2020-8927BIT-dotnet-sdk-2020-8927BIT-powershell-2020-8927CVE-2020-8927GO-2025-3726PYSEC-2020-29RUSTSEC-2021-0131RUSTSEC-2021-0132RHSA-2021:1702UBUNTU-CVE-2020-36846UBUNTU-CVE-2020-8927USN-4568-1DEBIAN-CVE-2020-8927DLA-2476-1DSA-4801-1CGA-p52r-g378-cpwxCGA-vr58-8j2w-8rq3SUSE-SU-2023:3827-1SUSE-SU-2024:1968-1openSUSE-SU-2020:1578-1openSUSE-SU-2021:3942-1openSUSE-SU-2024:11708-1openSUSE-SU-2026:11988-1ALPINE-CVE-2020-8927MGASA-2020-0385SUSE-SU-2021:3942-1SUSE-SU-2023:3669-1SUSE-SU-2023:3670-1
Published 30-05-2025Last modified 30-05-2025
Vulnerability summary
CVE-2020-36846 is a critical (CVSS 9.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.66%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 30-05-2025PublishedVulnerability first disclosed.
- 30-05-2025Last modifiedVulnerability information updated.
Description
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
CVSS metrics
15 scores · 11 sources · 3 versionsMedium 6.9Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NSourcesAll 3 agree
- OSV · NugetEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- OSV · Crates.ioEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources11 sources · 6.5–9.8
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · NugetEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · Crates.ioEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.63% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1395Dependency on Vulnerable Third-Party ComponentThe product has a dependency on a third-party component that contains one or more known vulnerabilities.
- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
NuGet116 products
- Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm≥ 6.0.0, < 6.0.3
- Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64≥ 6.0.0, < 6.0.3
- Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64≥ 6.0.0, < 6.0.3
- Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86≥ 6.0.0, < 6.0.3
- Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm≥ 6.0.0, < 6.0.3
Suse10 products
- brotli&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.0.7-3.3.1
- brotli&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 1.0.7-3.3.1
- python-Brotli&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 1.0.7-150200.3.3.1
- python-Brotli&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 1.0.7-150200.3.3.1
- python-brotlipy&distro=SUSE Linux Enterprise Module for Public Cloud 12< 0.6.0-2.6.1
Opensuse8 products
- leapEOL15.2
- brotli&distro=openSUSE Leap 15.2< 1.0.9-lp152.2.3.1
- brotli&distro=openSUSE Leap 15.3< 1.0.7-3.3.1
- cargo-audit-advisory-db&distro=openSUSE Tumbleweed< 20220105-1.1
- python-Brotli&distro=openSUSE Leap 15.5< 1.0.7-150200.3.3.1
Redhat6 products
- brotli< 0:1.0.6-3.el8
- brotli-debuginfo< 0:1.0.6-3.el8
- brotli-debugsource< 0:1.0.6-3.el8
- brotli-devel< 0:1.0.6-3.el8
- python3-brotli< 0:1.0.6-3.el8
Microsoft5 products
- .net≥ 5.0, ≤ 5.0.14
- .net_core≥ 3.1, ≤ 3.1.22
- powershell≥ 7.0, < 7.0.9 | ≥ 7.1, < 7.1.6 | ≥ 7.2, < 7.2.2
- visual_studio_2019≥ 16.0, ≤ 16.11
- visual_studio_2022≥ 17.0, ≤ 17.0.7 | 17.1
Crates.Io2 products
- brotli-sys≥ 0.0.0-0 (No fix recorded)
- compu-brotli-sys< 1.0.9 | ≥ 0.0.0-0, < 1.0.9
Debian2 products
- brotli< 1.0.7-2+deb10u1 | < 0.5.2+dfsg-2+deb9u1 | < 1.0.9-1
- debian_linuxEOL9.0 | 10.0
Ubuntu2 products
- brotli< 1.0.3-1ubuntu1~16.04.2 | < 1.0.3-1ubuntu1.3 | < 1.0.7-6ubuntu0.1
- libio-compress-brotli-perlAll versions (No fix recorded)
Alpine1 product
- brotli< 1.0.9-r0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 20.04
Chainguard1 product
- brotliAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL31 | 32 | 33 | 34 | 35 | 36
Github.com/google1 product
- brotliAll versions (No fix recorded)
Google1 product
- brotli< 1.0.8
Mageia1 product
- brotli< 1.0.7-2.1.mga7
PyPI1 product
- brotli< 1.0.8
Timlegge1 product
- io::compress::brotli< 0.007
Wolfi1 product
- brotliAll versions (No fix recorded)
18 vendors · 161 products
References
70 linksShow all 70 references
lists.debian.org/debian-lts-announce/2020/12/msg00003.htmlWEBAdvisoryMailing ListThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.htmlWEBAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- crates.io/crates/brotli-sysPACKAGE