{"schema_version":"1","data":[{"id":19310,"advisory_id":"a038abfe-8611-4556-90a4-46d4522d47fc","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/367","source_published_at":"2026-10-23T22:29:11+00:00","published_at":"2026-10-25T02:19:22.728522+00:00","extraction_method":"llm","technologies":["io-compress-brotli","oss-security"],"cve_ids":["CVE-2026-111497","CVE-2026-115936"],"event_types":["patch"],"payload":{"kind":"patch","title":"CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder","summary":"IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later.","products":[{"name":{"value":"IO::Compress::Brotli","evidence":"IO::Compress::Brotli versions from 0.004001 before 0.023"},"prerequisites":[{"value":"Any caller that decompresses untrusted data with unbro or the decompress method","evidence":"Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder."}],"fixed_versions":[{"value":"0.023","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later."}],"affected_versions":[{"value":"from 0.004001 before 0.023","evidence":"Versions: from 0.004001 before 0.023"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115936","evidence":"CVE ID: CVE-2026-115936"},{"value":"CVE-2026-111497","evidence":"described in CVE-2026-111497"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19308,"advisory_id":"5ebf49ca-97d4-4f95-b8ec-757ec93f6c5e","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/373","source_published_at":"2026-10-24T16:36:32+00:00","published_at":"2026-10-25T02:07:34.106233+00:00","extraction_method":"llm","technologies":["google-brotli","oss-security"],"cve_ids":["CVE-2026-111497"],"event_types":["patch"],"payload":{"kind":"patch","title":"Brotli release v1.2.1","summary":"Google Brotli published a library release addressing a vulnerability that also affects consumers of the library.","evidence":"https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.","products":[{"name":{"value":"Google brotli","evidence":"underlying problem is not restricted to Node.js alone, but rather in Google brotli"},"prerequisites":[],"fixed_versions":[{"value":"v1.2.1","evidence":"https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-111497","evidence":"Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19310,"next_before":19308}