5.3

CVE-2020-8927: google llc brotli

CVSS: 5.3v3.1MediumPublished
AliasesALPINE-CVE-2020-8927MGASA-2020-0385SUSE-SU-2021:3942-1
Published 15-09-2020Last modified 29-05-2026
Open JSON

Vulnerability summary

CVE-2020-8927 is a medium (CVSS 5.3) vulnerability in google llc brotli. EPSS estimates a 3.22% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
3.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
RHSA-2022:0827RHSA-2022:0828RHSA-2022:0829RHSA-2022:0830CGA-9MXG-J38P-8P8RCGA-WWXX-79X9-PXV3

Timeline

  1. 15-09-2020
    PublishedVulnerability first disclosed.
  2. 29-05-2026
    Last modifiedVulnerability information updated.

Description

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

3.22%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.22% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse11 products
  • brotli&distro=SUSE Linux Enterprise Micro 5.1< 1.0.7-3.3.1
  • brotli&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.0.7-3.3.1
  • brotli&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 1.0.7-3.3.1
  • python-Brotli&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 1.0.7-150200.3.3.1
  • python-Brotli&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 1.0.7-150200.3.3.1
Opensuse3 products
  • python-Brotli&distro=openSUSE Leap 15.5< 1.0.7-150200.3.3.1
  • python-brotlipy&distro=openSUSE Leap 15.4< 0.7.0-150300.3.3.1
  • python-brotlipy&distro=openSUSE Leap 15.5< 0.7.0-150300.3.3.1
Alpine1 product
  • brotli< 1.0.9-r0
Google llc1 product
Mageia1 product
  • brotli< 1.0.7-2.1.mga7

5 vendors · 17 products

References

26 links
Show all 26 references