{"id":"CVE-2020-36846","aliases":["BIT-brotli-2020-8927","BIT-dotnet-2020-8927","BIT-dotnet-sdk-2020-8927","BIT-powershell-2020-8927","EUVD-2025-16444","GHSA-44qx-v2f9-7rq9","GHSA-5v8v-66v8-mwm7","GO-2025-3726","PYSEC-2020-29","RUSTSEC-2021-0131","RUSTSEC-2021-0132","UBUNTU-CVE-2020-36846","openSUSE-SU-2025:15225-1"],"status":"published","title":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00661,"percentile":0.51887,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120","CWE-1395"],"published":"2020-09-15T10:15:00Z","modified":"2026-10-24T10:50:07Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"brotli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"powershell","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.9"},{"introduced":"7.1.0"},{"fixed":"7.1.6"},{"introduced":"7.2.0"},{"fixed":"7.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"compu-brotli-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.9"}]}],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.browser-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.osx-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.win-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.Mono.win-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.win-x86","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}],"versions":["6.0.0","6.0.1","6.0.2"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8"}]}],"versions":["0.5.2","0.6.0","1.0.1","1.0.4","1.0.6","1.0.7"],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/google/brotli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8"}]}],"versions":["0.5.2","0.6.0","1.0.1","1.0.4","1.0.6","1.0.7"],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"brotli-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"compu-brotli-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.0.9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libio-compress-brotli-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.004001-2","0.004001-2build1","0.004001-2build2","0.004001-2build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libio-compress-brotli-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.004001-2build4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libio-compress-brotli-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.019000-1","0.019000-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libio-compress-brotli-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.004001-2build4","0.019000-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250612T141001-1.1"}]}],"bundled":29}],"products":[{"vendor":"timlegge","product":"io::compress::brotli"}],"references":[{"url":"https://github.com/google/brotli/pull/826","tags":["issue-tracking","fix","report"]},{"url":"https://github.com/advisories/GHSA-5v8v-66v8-mwm7","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://github.com/timlegge/perl-IO-Compress-Brotli/blob/8b44c83b23bb4658179e1494af4b725a1bc476bc/Changes#L52","tags":["mitigation","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8927","tags":["vdb-entry","web","advisory","report"]},{"url":"https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6","tags":["patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36846","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44qx-v2f9-7rq9"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html","tags":["advisory","web"]},{"url":"https://github.com/google/brotli/releases/tag/v1.0.9","tags":["advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html","tags":["advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/","tags":["web"]},{"url":"https://usn.ubuntu.com/4568-1/","tags":["advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4801","tags":["advisory","web"]},{"url":"https://github.com/bitemyapp/brotli2-rs/issues/45","tags":["web","report"]},{"url":"https://github.com/github/advisory-database/issues/785","tags":["web"]},{"url":"https://usn.ubuntu.com/4568-1","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0132.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0131.html","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2020-29.yaml","tags":["web"]},{"url":"https://github.com/google/brotli/releases/tag/v1.0.8","tags":["web"]},{"url":"https://github.com/bitemyapp/brotli2-rs","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/","tags":["web"]},{"url":"https://crates.io/crates/brotli-sys","tags":["package"]},{"url":"https://crates.io/crates/compu-brotli-sys","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-36846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36846","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/30005245/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49140","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-36846","title":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T00:50:28.582Z","modified":"2025-05-30T22:01:41.998Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2025-16444","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T00:50:28Z","modified":"2025-05-30T22:01:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:33.750801Z"}],"ghsa":[{"id":"GHSA-44qx-v2f9-7rq9","title":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. ...","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T03:30:31Z","modified":"2025-05-31T00:31:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:02:31.34634Z"}],"nvd":[{"id":"CVE-2020-36846","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T01:15:20.95Z","modified":"2026-06-17T03:16:19.05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:06:48.591569Z"}],"osv":[{"id":"CVE-2020-36846","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T01:15:20.95Z","modified":"2026-10-20T14:13:58.442253756Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"CVE-2020-8927","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2020-09-15T10:15:12.887Z","modified":"2026-10-24T10:50:07.10083843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"GHSA-5v8v-66v8-mwm7","title":"Integer overflow in the bundled Brotli C library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2022-05-24T17:28:21Z","modified":"2026-09-10T03:49:47.62630546Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2020-36846","description":"A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-05-30T01:15:00Z","modified":"2026-10-17T12:56:14.459204703Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"BIT-brotli-2020-8927","title":"Buffer overflow in Brotli library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2024-03-06T10:50:45.386Z","modified":"2026-09-10T16:01:10.656797329Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-dotnet-2020-8927","title":"Buffer overflow in Brotli library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2024-03-06T11:00:33.493Z","modified":"2026-09-10T16:01:00.030000717Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2020-8927","title":"Buffer overflow in Brotli library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2024-03-06T11:00:44.378Z","modified":"2026-09-10T16:00:59.306837112Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-powershell-2020-8927","title":"Buffer overflow in Brotli library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2025-09-04T17:48:34.485Z","modified":"2026-09-10T16:01:46.001675215Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"GO-2025-3726","title":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli","description":"IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli","status":"published","published":"2025-06-03T17:57:59Z","modified":"2026-03-03T04:56:39.449382Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.823164Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"PYSEC-2020-29","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2020-09-15T10:15:00Z","modified":"2026-06-10T17:00:38.605765812Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"RUSTSEC-2021-0131","title":"Integer overflow in the bundled Brotli C library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB.\n\nAn updated version of `brotli-sys` has not been released. If one cannot update the C library, its authors recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.\n\nIn Rust the issue can be mitigated by migrating to the `brotli` crate, which provides a Rust implementation of Brotli compression and decompression that is not affected by this issue.","status":"published","published":"2021-12-20T12:00:00Z","modified":"2025-09-04T18:27:28.943295Z","updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"RUSTSEC-2021-0132","title":"Integer overflow in the bundled Brotli C library","description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB.\n\nIf one cannot update the C library, its authors recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","status":"published","published":"2021-12-20T12:00:00Z","modified":"2025-10-28T06:02:18Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}