CVE-2026-115946 Details
Description
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
A vulnerability exists in Google XS::libbrotli versions prior to 1.2.1.0, where a bundled Brotli library introduces an out-of-bounds write in the decoder. This issue is present in the static archives linked to dependent XS modules, rather than utilizing the system library. The vulnerable Brotli versions 1.0.7 and 1.1.0, included in the bundle, carry the same out-of-bounds write vulnerability described in CVE-2026-111497. The flaw can be exploited by an attacker who sends a crafted Brotli-compressed stream, leading to decoder state corruption, memory disclosure, process crashes, or potentially arbitrary code execution. Upgrading the system Brotli library does not address this vulnerability.
Users should update to XS::libbrotli version 1.2.1.0 or later. Instructions for downloading this version are available on MetaCPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/google/brotli/releases/tag/v1.2.1 | CPANSec | Release NotesVendor |
| https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes | CPANSec | Vendor |
| https://www.cve.org/CVERecord?id=CVE-2026-111497 | CPANSec | AdvisoryBundle |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| XS::libbrotli | >= 1.0.7, <= 1.0.7 (semver) >= 1.1.0, <= 1.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | CPANSec |