Out-of-Bounds Write Vulnerability in XS::libbrotli by Perl
CVE-2026-115946

Currently unrated

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-115946?

The XS::libbrotli, a Perl module, contains an out-of-bounds write vulnerability due to a flawed implementation of the bundled brotli library (versions 1.0.7 and 1.1.0). This flaw allows attackers to exploit untrusted data processed by dependent modules, potentially corrupting the decoder state, disclosing sensitive memory contents, crashing the associated processes, or even executing arbitrary code. Upgrading the xs::libbrotli to version 1.2.1.0 is essential, but simply upgrading the system brotli library does not mitigate the issue.

References

https://www.cve.org/CVERecord?id=CVE-2026-111497
vendor-advisoryrelated
https://github.com/google/brotli/releases/tag/v1.2.1
release-notes
https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.