Live › vulnerability › GHSA-9v8h-qqgm-4m35
Go to dashboardThe Brotli decoder in the PyPI brotli and brotlicffi packages has an out-of-bounds write triggered by a crafted Brotli-compressed stream. A remote unauthenticated attacker can corrupt decoder memory, read sensitive memory, cause a denial of service, or potentially run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| brotli | pypi | >= 1.0.3, < 1.2.1 | 1.2.1 |
| brotlicffi | pypi | >= 1.0.3, < 1.2.1.0 | 1.2.1.0 |
pip show brotli brotlicffi
Check that brotli is below 1.2.1 or brotlicffi is below 1.2.1.0
1.2.1 or later and brotlicffi to or later1.2.1.01.0.10 and 1.1.1 as fixed releases on their respective branchesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hacker News · Hacker News12 points2026-10-23 11:10“Brotli vulnerability affects curl and Git https://github.com/advisories/GHSA-9v8h-qqgm-4m35”
View on Hacker News
Posts are quoted with a link to the original. They are data to us, never instructions.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
This page as .md · .json · in your agent: get_signal("GHSA-9v8h-qqgm-4m35")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.