GHSA-9V8H-QQGM-4M35: brotli PyPI
Vulnerability summary
GHSA-9V8H-QQGM-4M35 is a critical (CVSS 9.2) vulnerability in brotli PyPI.
Severe, CVSS 9.2 (OSV · Pypi); no exploitation reported by the 5 checked sources; EPSS not yet published
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 22-10-2026PublishedVulnerability first disclosed.
- 23-10-2026Last modifiedVulnerability information updated.
Description
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
PyPI2 products
- brotli≥ 1.0.3, < 1.2.1
- brotlicffi≥ 1.0.3, < 1.2.1.0
1 vendor · 2 products
References
17 links
Show all 17 references
- github.com/google/brotliPACKAGE