GHSA-9v8h-qqgm-4m35: Buffer Overflow

Q: What must an attacker be able to do to exploit this issue?

An attacker must be able to supply a crafted Brotli-compressed stream to a vulnerable decoder. The advisory describes the attack as remote and unauthenticated.

Q: How can I determine whether my environment needs remediation?

Inventory Brotli libraries and binaries, including installations associated with pip/brotlicffi and pip/brotli. Versions from 1.0.3 through 1.2.0 are affected.

Q: What versions should be used to remediate affected installations?

Update affected Brotli libraries or binaries to the latest available fixed release identified by the advisory: 1.0.10, 1.1.1, or 1.2.1. The provided information does not identify a configuration-only workaround.

Published Oct 22, 2026

Updated

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Affected Software

2 affected componentsFixes available

pip/brotlicffi>=1.0.3<1.2.1.0

1.2.1.0

pip/brotli>=1.0.3<1.2.1

1.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/brotlicffi to a version that resolves this vulnerability.
Fixed in 1.2.1.0
Upgrade
Upgrade pip/brotli to a version that resolves this vulnerability.
Fixed in 1.2.1
Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.0.10
Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.1.1
Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.2.1

Event History

Oct 22, 2026

Advisory Published

via GitHub·03:32 PM

Data Sourced

via GitHub·03:32 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker must be able to supply a crafted Brotli-compressed stream to a vulnerable decoder. The advisory describes the attack as remote and unauthenticated.

How can I determine whether my environment needs remediation?

Inventory Brotli libraries and binaries, including installations associated with pip/brotlicffi and pip/brotli. Versions from 1.0.3 through 1.2.0 are affected.

What versions should be used to remediate affected installations?

Update affected Brotli libraries or binaries to the latest available fixed release identified by the advisory: 1.0.10, 1.1.1, or 1.2.1. The provided information does not identify a configuration-only workaround.

GHSA-9v8h-qqgm-4m35: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

How can I determine whether my environment needs remediation?

What versions should be used to remediate affected installations?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

How can I determine whether my environment needs remediation?

What versions should be used to remediate affected installations?