CVE-2020-36846
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1...
Affects 0 products across 2 vendors.
A buffer overflow vulnerability exists in the embedded Brotli library within versions of IO::Compress::Brotli prior to 0.007, allowing an attacker to trigger a crash by controlling the input length of a decompression request.
BSID: BS-2025-GLOBAL-205603-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2020-36846?
What is the CVSS score for CVE-2020-36846?
Is CVE-2020-36846 actively exploited?
How do I remediate CVE-2020-36846?
What systems are affected by CVE-2020-36846?
| CVE ID | CVE-2020-36846 |
|---|---|
| BSID | BS-2025-GLOBAL-205603-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2025-05-30 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Source | NVD |
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Source: NIST NVD / MITRE CVE Database
An attacker can exploit this vulnerability by providing a specially crafted input to a script that uses the affected version of IO::Compress::Brotli. The vulnerability is triggered during the 'one-shot' decompression process when handling data chunks larger than 2 GiB, leading to a buffer overflow and potential crash.
Exploitation Likelihood: HIGH
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 157d889be9d034396448e18a55104883281f8b4ec99364f6766853506ed72d8c935c921c21c84b10ad1ad31ceeb4b028e7fa2c6046cec67274c285f7bc52f80f |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →