TI-2020-18981 Aliases CVE-2020-36846 GHSA-44qx-v2f9-7rq9

IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

MEDIUM 50CWE-1395Published 2025-05-30 · Updated 2025-05-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00661 51st percentileScored 2026-11-07

Fix Fixed IO::Compress::Brotli (TIMLEGGE): 0.007

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TIMLEGGE	IO::Compress::Brotli	before 0.007	0.007	Patch available	CNA

IO::Compress::Brotli VendorTIMLEGGE Affected before 0.007 Fixed in 0.007 Patch available CNA

Remediation

Fix · CNA IO::Compress::Brotli (TIMLEGGE) Fixed in 0.007

Timeline

2026-10-02 Threatist record created from CVE-2020-36846
2026-10-03 Alias added: GHSA-44qx-v2f9-7rq9
2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6

Advisory 1

https://github.com/advisories/GHSA-5v8v-66v8-mwm7

Other 3

TI-2026-23735 Integer overflow in TIMLEGGE Crypt::NaCl::Sodium CVSS 3.1CRITICAL 9.8
TI-2026-14905 Improper signature verification in TIMLEGGE Net::SAML2 CVSS 3.1CRITICAL 9.8
TI-2026-08239 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup CVSS 3.1CRITICAL 9.1
TI-2026-10497 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-08334 Improper signature verification in TIMLEGGE XML::Sig CVSS 3.1CRITICAL 9.1
TI-2026-02211 Integer overflow in TIMLEGGE Crypt::NaCl::Sodium CVSS 3.1CRITICAL 9.1

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences