{"schema_version":"1","data":[{"id":19310,"advisory_id":"a038abfe-8611-4556-90a4-46d4522d47fc","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/367","source_published_at":"2026-10-23T22:29:11+00:00","published_at":"2026-10-25T02:19:22.728522+00:00","extraction_method":"llm","technologies":["io-compress-brotli","oss-security"],"cve_ids":["CVE-2026-111497","CVE-2026-115936"],"event_types":["patch"],"payload":{"kind":"patch","title":"CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder","summary":"IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later.","products":[{"name":{"value":"IO::Compress::Brotli","evidence":"IO::Compress::Brotli versions from 0.004001 before 0.023"},"prerequisites":[{"value":"Any caller that decompresses untrusted data with unbro or the decompress method","evidence":"Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder."}],"fixed_versions":[{"value":"0.023","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later."}],"affected_versions":[{"value":"from 0.004001 before 0.023","evidence":"Versions: from 0.004001 before 0.023"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115936","evidence":"CVE ID: CVE-2026-115936"},{"value":"CVE-2026-111497","evidence":"described in CVE-2026-111497"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19310,"next_before":19310}