CVE-2026-115946: XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

Published Oct 31, 2026

Updated

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.

Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.

XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.

Event History

Oct 31, 2026

CVE Published

via MITRE·11:49 PM

Data Sourced

via MITRE·11:49 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:49 PM

DescriptionWeakness

Nov 1, 2026

Data Sourced

via NVD·12:16 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed when they use XS::libbrotli before 1.2.1.0 together with a dependent XS module that decompresses untrusted brotli data. XS::libbrotli itself has no Perl interface; exposure occurs through those dependent modules.

What does an attacker need to exploit the vulnerability?

An attacker needs to be able to supply a crafted brotli stream to a dependent module that uses the bundled decoder. Successful exploitation can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code.

Will upgrading the operating system's brotli package fix affected Perl modules?

No. Affected XS::libbrotli releases compile their bundled brotli copy into static archives that dependent XS modules link at build time, rather than using the system library.

What remediation is identified for affected installations?

Upgrade XS::libbrotli to version 1.2.1.0, which updates the bundled brotli library to 1.2.1. After upgrading, dependent XS modules that linked the static archive at build time may need to be rebuilt to use the updated bundled library.

CVE-2026-115946: XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Will upgrading the operating system's brotli package fix affected Perl modules?

What remediation is identified for affected installations?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Will upgrading the operating system's brotli package fix affected Perl modules?

What remediation is identified for affected installations?