CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder
IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Upgrade to IO-Compress-Brotli 0.023 or later.
IO::Compress::Brotli
IO::Compress::Brotli versions from 0.004001 before 0.023
- Affected versions
- from 0.004001 before 0.023
Versions: from 0.004001 before 0.023
- Fixed versions
- 0.023
Upgrade to IO-Compress-Brotli 0.023 or later.
- Prerequisites
- Any caller that decompresses untrusted data with unbro or the decompress method
Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder.
- Related CVEs
- CVE-2026-115936
CVE ID: CVE-2026-115936
CVE-2026-111497described in CVE-2026-111497
Publisher severity
No explicit severity was extracted.