CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder

As cited

Copy frozen at 2026-10-24 01:38 UTC (site build).

vulnerabilities

CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder

CVE-2026-115936 affects IO::Compress::Brotli for Perl in versions 0.004001 through 0.022, which bundle a brotli library containing an out-of-bounds write vulnerability in the decoder. Affected Perl users should upgrade to version 0.023 or later.

Why it matters: Perl developers and system administrators using IO::Compress::Brotli need to patch immediately, as the out-of-bounds write could enable remote code execution or crash the decoder process.

Source published

2026-10-23 22:29 UTC

First seen by Cybersecurity Tracker

2026-10-24 00:39 UTC