CVE-2020-36846
Critical
Description
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
SeverityCritical
CVSS9.8
Exploit probability—
ProductBrotli
PublishedMay 30, 2025
First seenMay 30, 2025
Weakness typeCWE-1395CWE-1395
How to fix
Update
- brotli1.0.8 or later
- compu-brotli-sys1.0.9 or later
- Microsoft.NETCore.App.Runtime.linux-arm3.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.linux-arm643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.linux-musl-arm643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.linux-x643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.osx-x643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.win-arm3.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.win-arm643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.win-x643.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.win-x863.1.23, 5.0.15, 6.0.3 or later
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm645.0.15, 6.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| brotliPyPI | v < 1.0.8 | 1.0.8 |
| compu-brotli-syscrates.io | v < 1.0.9 | 1.0.9 |
| Microsoft.NETCore.App.Runtime.linux-armNuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.linux-arm64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.linux-x64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.osx-x64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.win-armNuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.win-arm64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.win-x64NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.win-x86NuGet | 3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 3.1.23, 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.linux-armNuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.linux-arm64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.linux-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.osx-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.browser-wasmNuGet | 5.0.0 ≤ v < 5.0.15 | 5.0.15 |
| Microsoft.NETCore.App.Runtime.linux-musl-armNuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet | 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.3 | 5.0.15, 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasmNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasmNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasmNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.browser-wasmNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-armNuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.osx-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvos-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.win-x64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.Mono.win-x86NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| Microsoft.NETCore.App.Runtime.osx-arm64NuGet | 6.0.0 ≤ v < 6.0.3 | 6.0.3 |
| github.com/google/brotliGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.