CVE-2026-115946 SYBER CVE debrief

Who should care

Defenders responsible for Perl applications using XS::libbrotli should assess exposure and prioritize upgrading to version 1.2.1.0 or later. They should review dependent modules that use the bundled brotli library and verify the vulnerability status of their systems. Defenders should also monitor for potential exploitation attempts and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should prioritize upgrading XS::libbrotli to version 1.2.1.0 or later, and review dependent modules that use the bundled brotli library, as an attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code.

• Corruption of decoder state, disclosure of memory, or process crashes are possible if an attacker supplies a crafted brotli stream.
• Potential execution of arbitrary code if the vulnerability is exploited.
• Verification of dependent modules that use the bundled brotli library is necessary to ensure they are not vulnerable.
• Upgrading XS::libbrotli to version 1.2.1.0 or later is necessary to remediate the vulnerability.

Technical summary

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. The vulnerability is due to a bundled brotli library, 1.0.7 or 1.1.0, that carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code.

Defensive priority

Defenders should prioritize upgrading XS::libbrotli to version 1.2.1.0 or later, and review dependent modules that use the bundled brotli library.

Recommended defensive actions

• Upgrade XS::libbrotli to version 1.2.1.0 or later
• Review dependent modules that use the bundled brotli library
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide information about the vulnerability in XS::libbrotli and the affected versions. The NVD entry is currently not available. Evidence is limited, so defenders should verify the vulnerability status of their systems and review dependent modules that use the bundled brotli library. The vulnerability is due to a bundled brotli library, 1.0.7 or 1.1.0, that carries the decoder out-of-bounds write described in CVE-2026-111497.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.