Review
SYBER
CVE published 2026-11-01
CVE-2026-115946
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. The vulnerability is due to a bundled brotli library, 1.0.7 or 1.1.0, that carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompr [truncated]