The official CVE record is not published yet
Listed from a security news or mailing-list post. Details may change. It will be replaced with the CVE.org / NVD record once published.
IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder
Summary
Posted by Timothy Legge on Oct 23======================================================================== CVE-2026-115936 CPAN Security Group ======================================================================== CVE ID: CVE-2026-115936 Distribution: IO-Compress-Brotli Versions: from 0.004001 befo...
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-115936 libio-compress-brotli-perl
Original description The description as published by the source.
Posted by Timothy Legge on Oct 23======================================================================== CVE-2026-115936 CPAN Security Group ======================================================================== CVE ID: CVE-2026-115936 Distribution: IO-Compress-Brotli Versions: from 0.004001 before 0.023 MetaCPAN: https://metacpan.org/dist/IO-Compress-Brotli VCS Repo:...
(oss-security (Openwall): CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder)
Source: oss-security (Openwall) NVD