| id: GO-2025-3726 |
| modules: |
| - module: github.com/google/brotli |
| unsupported_versions: |
| - cve_version_range: 'affected from 0 before 0.007 (default: unaffected)' |
| vulnerable_at: 1.1.0 |
| summary: |- |
| IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow |
| in the bundled Brotli C library in github.com/google/brotli |
| cves: |
| - CVE-2020-36846 |
| credits: |
| - Robert Rothenberg (RRWO) |
| references: |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2020-36846 |
| - fix: https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6 |
| - fix: https://github.com/google/brotli/pull/826 |
| - web: https://github.com/advisories/GHSA-5v8v-66v8-mwm7 |
| - web: https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52 |
| - web: https://nvd.nist.gov/vuln/detail/CVE-2020-8927 |
| source: |
| id: CVE-2020-36846 |
| created: 2025-06-03T13:24:22.322344-04:00 |
| review_status: UNREVIEWED |
