Skip to content

Product

debian/brotli vulnerabilities

6 published CVES affecting debian/brotli, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
1
High
2
Medium
1
Low
0
Unscored
2
CISA KEV
1

Latest debian/brotli CVEs

Newest publication first

  1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

    Published
    CriticalCVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

  4. CVE-2020-8927 Buffer overflow in Brotli library

    Published
    MediumCVSS 6.5 EPSS 3.3%

    A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to upda...

  6. CVE-2016-1624 Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflo...

    Published
    HighCVSS 8.8 EPSS 1.4%

    Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compre...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.