{"id":"CVE-2026-115946","kind":"vulnerability","aliases":["CVE-2026-115946"],"related":[],"title":"XS::libbrotli for Perl: decoder out-of-bounds write from bundled brotli","description":"XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.\n\nAffected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.\n\nXS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.","summary":"XS::libbrotli versions before 1.2.1.0 bundle a brotli library whose decoder has an out-of-bounds write. A crafted compressed stream sent to a Perl module that decompresses untrusted data can corrupt memory, leak data, crash the process, or potentially run arbitrary code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brotli","package","perl","xs-libbrotli"],"not_affected_if":["no-untrusted-brotli-input"],"how_to_check":"- Check the installed XS::libbrotli version with `perl -MXS::libbrotli -e 'print $XS::libbrotli::VERSION'` or the module's entry in the Perl dependency list.\n- Find dependent XS modules that decompress untrusted brotli data (`perl -MModule::Name` in the dependency tree).\n- Upgrading the system brotli does not remediate this, per the sources.","fix":"- XS::libbrotli: upgrade to `1.2.1.0` or later (bundles brotli `1.2.1`).","status":"open","published_at":"2026-11-01T00:16:34+00:00","first_seen_at":"2026-11-01T00:46:59+00:00","triaged_at":"2026-11-01T00:47:16+00:00","updated_at":"2026-11-01T00:47:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T00:47:16Z","model":"claude-haiku-5-5","output":{"fix":"- XS::libbrotli: upgrade to `1.2.1.0` or later (bundles brotli `1.2.1`).","reach":"unknown","title":"XS::libbrotli for Perl: decoder out-of-bounds write from bundled brotli","impact":"high","summary":"XS::libbrotli versions before 1.2.1.0 bundle a brotli library whose decoder has an out-of-bounds write. A crafted compressed stream sent to a Perl module that decompresses untrusted data can corrupt memory, leak data, crash the process, or potentially run arbitrary code.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","xs-libbrotli","brotli"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code in a process decompressing their data.","analyst_note":"Sources give no CVSS score or exploitation status; confirm the severity and the list of dependent modules that decode untrusted brotli input, and check CVE-2026-111497 for the underlying brotli flaw.","how_to_check":"- Check the installed XS::libbrotli version with `perl -MXS::libbrotli -e 'print $XS::libbrotli::VERSION'` or the module's entry in the Perl dependency list.\n- Find dependent XS modules that decompress untrusted brotli data (`perl -MModule::Name` in the dependency tree).\n- Upgrading the system brotli does not remediate this, per the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-brotli-input"],"who_is_affected":"Affected builds compile a bundled brotli into static archives that dependent XS modules link against, so exposure comes through any Perl module that decompresses untrusted data with it. XS::libbrotli has no Perl interface of its own. Systems that never decompress attacker-supplied brotli data have a smaller exposure; the sources do not say which dependent modules are common.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000793,"input_tokens":4304,"output_tokens":725,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111497':136C '-115946':16A,19A '-2026':15A,18A,135C '1.0.7':118C '1.1.0':120C '1.2.1':143C '1.2.1.0':30B,74C,138C 'across':121C 'affect':91C 'arbitrari':68B,184C 'archiv':99C 'attack':166C 'bound':9A,42B,86C,130C 'brot':13A,20B,33B,79C,96C,142C,170C,189C 'build':107C 'bundl':12A,31B,77C,95C,116C 'carri':124C 'code':69B,185C 'compil':93C 'compress':46B 'copi':117C 'corrupt':58B,173C 'craft':45B,169C 'crash':62B,178C 'cve':14A,17A,134C 'data':56B,61B,162C 'decod':5A,36B,90C,126C,152C,174C 'decompress':54B,160C 'depend':101C,157C 'describ':132C 'disclos':176C 'execut':183C 'interfac':149C 'leak':60B 'libbrot':2A,25B,27B,71C,145C 'librari':34B,80C,114C 'link':104C 'memori':59B,177C 'modul':52B,103C,158C 'out-of-bound':6A,39B,83C,127C 'packag':21B 'perl':4A,22B,51B,76C,148C 'potenti':66B,182C 'process':64B,180C 'rang':123C 'rather':109C 'reach':154C 'remedi':192C 'run':67B 'sent':48B 'state':175C 'static':98C 'stream':47B,171C 'suppli':167C 'system':113C,188C 'time':108C 'untrust':55B,161C 'updat':139C 'upgrad':186C 'use':111C 'version':28B,72C,92C,137C 'whose':35B 'write':10A,43B,87C,131C 'xs':1A,24B,26B,70C,102C,144C 'xs-libbrot':23B","nicknames":[],"mitigations":[],"who_affected":"Affected builds compile a bundled brotli into static archives that dependent XS modules link against, so exposure comes through any Perl module that decompresses untrusted data with it. XS::libbrotli has no Perl interface of its own. Systems that never decompress attacker-supplied brotli data have a smaller exposure; the sources do not say which dependent modules are common.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T00:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115946","severity":null,"published_at":"2026-11-01T00:16:34+00:00","modified_at":"2026-11-01T00:16:34+00:00","first_seen_at":"2026-11-01T00:46:59+00:00","fetched_at":"2026-11-01T00:46:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}