IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)
Severity: high · Patch status: patched · Since 2026-10-23 · CVE-2026-111497, CVE-2026-115936
The CPAN Security Group disclosed CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 bundle a copy of the brotli library (1.0.4 through 1.2.0) containing an out-of-bounds write in the decoder (CVE-2026-111497). Because the module compiles the bundled brotli rather than linking the system library, upgrading system brotli does not remediate. Any application decompressing untrusted data via unbro or the decompress method is exposed: a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Version 0.023, released 2026-10-23, updates the bundled brotli to 1.2.1 and fixes the issue. No in-the-wild exploitation reported.
What to do
- Upgrade IO-Compress-Brotli to 0.023 or later and rebuild/redeploy dependent applications
- Audit Perl codebases and dependencies for use of IO::Compress::Brotli, especially paths decompressing untrusted input
- Until patched, restrict or sandbox processing of untrusted brotli-compressed data
Fixed versions
Sources
All live incidents on Threat Watch
