Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.
XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to XS-libbrotli 1.2.1.0 or later and reinstall every XS module built against it.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 01 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this. | |
| Title | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder | |
| Weaknesses | CWE-1395 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-31T23:49:36.583Z
Reserved: 2026-10-23T23:40:26.063Z
Link: CVE-2026-115946
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-01T00:16:34.437
Modified: 2026-11-01T00:16:34.437
Link: CVE-2026-115946
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-01T02:00:17Z
-
CWE-1395
Dependency on Vulnerable Third-Party Component