CVE-2026-115946
Received Received - Intake

Out-of-Bounds Write in XS::libbrotli Perl Module

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: CPANSec

Description
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-115946

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
google brotli 1.0.7
google brotli 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

XS::libbrotli versions before 1.2.1.0 for Perl bundle a vulnerable brotli library with an out-of-bounds write in the decoder. The bundled library versions 1.0.7 or 1.1.0 contain a flaw described in CVE-2026-111497. This vulnerability allows attackers to corrupt decoder state, disclose memory, crash processes, or execute arbitrary code when untrusted brotli data is decompressed.

Detection Guidance

Check Perl modules using XS::libbrotli by running 'cpan -D XS::libbrotli' or inspecting installed modules with 'cpanm --list'. Look for modules that bundle brotli 1.0.7 or 1.1.0. Verify brotli versions in dependent modules with 'brotli --version' or 'ldd' on linked libraries.

Impact Analysis

If you use Perl modules that depend on XS::libbrotli and process untrusted brotli-compressed data, an attacker could exploit this to crash your application, leak sensitive memory, or run malicious code on your system. Upgrading system brotli does not fix this issue since the vulnerable library is bundled.

Compliance Impact

This vulnerability could lead to unauthorized code execution or memory disclosure, potentially violating data confidentiality requirements under GDPR and HIPAA. Organizations must address this flaw to maintain compliance with data protection standards.

Mitigation Strategies

Upgrade XS::libbrotli to version 1.2.1.0 or later. Rebuild dependent Perl modules to link against the updated library. Remove any statically linked vulnerable brotli copies in dependent modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart