A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Canonical
  • Ubuntu Linux
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Google
  • Brotli
Microsoft
  • .net
  • .net Core
  • Powershell
  • Visual Studio 2019
  • Visual Studio 2022
Opensuse
  • Leap
Redhat
  • Enterprise Linux
  • Rhel Dotnet

Configuration 1 [-]

cpe:2.3:a:google:brotli:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Configuration 5 [-]

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:17.1:*:*:*:*:*:*:*
Package CPE Advisory Released Date
.NET Core on Red Hat Enterprise Linux
rh-dotnet31-dotnet-0:3.1.417-1.el7_9 cpe:/a:redhat:rhel_dotnet:3.1::el7 RHSA-2022:0829 2022-03-10T00:00:00Z
rh-dotnet50-dotnet-0:5.0.212-1.el7_9 cpe:/a:redhat:rhel_dotnet:5.0::el7 RHSA-2022:0828 2022-03-10T00:00:00Z
Red Hat Enterprise Linux 8
brotli-0:1.0.6-3.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2021:1702 2021-05-18T00:00:00Z
dotnet3.1-0:3.1.417-1.el8_5 cpe:/a:redhat:enterprise_linux:8 RHSA-2022:0827 2022-03-10T00:00:00Z
dotnet5.0-0:5.0.212-1.el8_5 cpe:/a:redhat:enterprise_linux:8 RHSA-2022:0830 2022-03-10T00:00:00Z
brotli-0:1.0.6-3.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2021:1702 2021-05-18T00:00:00Z
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html cve-icon cve-icon
https://github.com/google/brotli/releases/tag/v1.0.9 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-8927 cve-icon
https://usn.ubuntu.com/4568-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-8927 cve-icon
https://www.debian.org/security/2020/dsa-4801 cve-icon cve-icon
History

Fri, 29 May 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Google

Published: 2020-09-15T09:15:12.000Z

Updated: 2026-05-29T20:52:34.416Z

Reserved: 2020-02-12T00:00:00.000Z

Link: CVE-2020-8927

cve-icon Vulnrichment

Updated: 2024-08-04T10:12:11.066Z

cve-icon NVD

Status : Modified

Published: 2020-09-15T10:15:12.887

Modified: 2024-11-21T05:39:41.370

Link: CVE-2020-8927

cve-icon Redhat

Severity : Important

Publid Date: 2020-08-27T00:00:00Z

Links: CVE-2020-8927 - Bugzilla