CPANSA-XS-libbrotli-2026-115946: XS-libbrotli vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-11-01T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-11-01T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | Severity | ||
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.
XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
Vulnerabilities
CVE-2026-115946
Vulnerability DescriptionXS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.
XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
Product status
Known affected
| Product | Score | ||||
|---|---|---|---|---|---|
| XS-libbrotli less than 1.2.1.0 |
|
Fixed
- XS-libbrotli greater than or equal 1.2.1.0
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-XS-libbrotli-2026-115946 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-xs-libbrotli-2026-115946.json - https://github.com/google/brotli/releases/tag/v1.2.1 external
https://github.com/google/brotli/releases/tag/v1.2.1 - https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes external
https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes - https://www.cve.org/CVERecord?id=CVE-2026-111497 external
https://www.cve.org/CVERecord?id=CVE-2026-111497 - CVE-2026-115946 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-115946
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Sun Nov 1 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/