CVE catalog

CVE-2020-8927

brotli: CVE-2020-8927

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: Sep 15, 2020, 10:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 3.22% · Oct 22, 2026

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	brotli	sid	`1.2.0-4`	fixed
Debian	brotli	forky	`1.2.0-4`	fixed
Debian	brotli	trixie	`1.1.0-2`	fixed
Debian	brotli	trixie-security	`1.1.0-2+deb13u1`	fixed
Debian	brotli	bookworm	`1.0.9-2`	fixed
Debian	brotli	bookworm-security	`1.0.9-2+deb12u1`	fixed
Opensuse	python-Brotli	tumbleweed	`1.2.0-1.6`	fixed
Alpine	brotli	3.12	`1.0.9-r0`	fixed
Alpine	brotli	3.13	`1.0.9-r0`	fixed
Alpine	brotli	3.14	`1.0.9-r0`	fixed
Alpine	brotli	3.15	`1.0.9-r0`	fixed
Alpine	brotli	3.16	`1.0.9-r0`	fixed
Alpine	brotli	3.17	`1.0.9-r0`	fixed
Alpine	brotli	3.18	`1.0.9-r0`	fixed
Alpine	brotli	3.19	`1.0.9-r0`	fixed
Alpine	brotli	3.20	`1.0.9-r0`	fixed
Alpine	brotli	3.21	`1.0.9-r0`	fixed
Alpine	brotli	3.22	`1.0.9-r0`	fixed
Alpine	brotli	3.23	`1.0.9-r0`	fixed
Alpine	brotli	3.24	`1.0.9-r0`	fixed
Ubuntu	brotli	16.04	`0.2.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2ubuntu1`	vulnerable
Ubuntu	brotli	16.04	`1.0.3-1ubuntu1~16.04.1`	vulnerable
Ubuntu	brotli	16.04	`1.0.3-1ubuntu1~16.04.2`	fixed
Ubuntu	brotli	18.04	`0.6.0-1build1`	vulnerable
Ubuntu	brotli	18.04	`1.0.2-2`	vulnerable
Ubuntu	brotli	18.04	`1.0.2-3`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1.2`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1.3`	fixed
Ubuntu	brotli	20.04	`1.0.7-2`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-2build1`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-4`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-5`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6build1`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6ubuntu0.1`	fixed
Ubuntu	brotli	16.04	`0.2.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2ubuntu1`	vulnerable
Ubuntu	brotli	16.04	`1.0.3-1ubuntu1~16.04.1`	vulnerable
Ubuntu	brotli	16.04	`1.0.3-1ubuntu1~16.04.2`	fixed
Ubuntu	brotli	18.04	`0.6.0-1build1`	vulnerable
Ubuntu	brotli	18.04	`1.0.2-2`	vulnerable
Ubuntu	brotli	18.04	`1.0.2-3`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1.2`	vulnerable
Ubuntu	brotli	18.04	`1.0.3-1ubuntu1.3`	fixed
Ubuntu	brotli	20.04	`1.0.7-2`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-2build1`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-4`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-5`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6build1`	vulnerable
Ubuntu	brotli	20.04	`1.0.7-6ubuntu0.1`	fixed
Opensuse	brotli	leap 15.2	`1.0.9-lp152.2.3.1`	fixed
Suse	brotli	linux enterprise micro 5.1	`1.0.7-3.3.1`	fixed
Suse	brotli	linux enterprise module for basesystem 15 sp2	`1.0.7-3.3.1`	fixed
Suse	brotli	linux enterprise module for basesystem 15 sp3	`1.0.7-3.3.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 15 sp3	`0.7.0-150300.3.3.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 15 sp4	`0.7.0-150300.3.3.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 15 sp5	`0.7.0-150300.3.3.1`	fixed
Opensuse	python-brotlipy	leap 15.4	`0.7.0-150300.3.3.1`	fixed
Opensuse	python-brotlipy	leap 15.5	`0.7.0-150300.3.3.1`	fixed
Suse	python-Brotli	linux enterprise module for python 3 15 sp6	`1.0.7-150200.3.3.1`	fixed
Suse	python-Brotli	linux enterprise module for server applications 15 sp5	`1.0.7-150200.3.3.1`	fixed
Opensuse	python-Brotli	leap 15.5	`1.0.7-150200.3.3.1`	fixed
Opensuse	cargo-audit-advisory-db	tumbleweed	`20220105-1.1`	fixed
Opensuse	brotli	leap 15.3	`1.0.7-3.3.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 12	`0.6.0-2.6.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 15 sp1	`0.7.0-150100.3.6.1`	fixed
Suse	python-brotlipy	linux enterprise module for public cloud 15 sp2	`0.7.0-150100.3.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	brotli	source	sid	`1.0.9-1`	not yet assigned	Not reported	Not reported
Debian	brotli	source	forky	`1.0.9-1`	not yet assigned	Not reported	Not reported
Debian	brotli	source	trixie	`1.0.9-1`	not yet assigned	Not reported	Not reported
Debian	brotli	source	bookworm	`1.0.9-1`	not yet assigned	Not reported	Not reported
Opensuse	python-Brotli	rpm	tumbleweed	`1.2.0-1.6`	Not reported	OPENSUSE-SU-2026:11988-1	Not reported
Alpine	brotli	apk	3.12	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.13	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.14	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.15	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.16	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.17	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.18	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.19	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.20	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.21	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.22	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.23	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Alpine	brotli	apk	3.24	`1.0.9-r0`	Not reported	ALPINE-CVE-2020-8927	Not reported
Ubuntu	brotli	deb	16.04	`1.0.3-1ubuntu1~16.04.2`	Not reported	UBUNTU-CVE-2020-8927	Not reported
Ubuntu	brotli	deb	18.04	`1.0.3-1ubuntu1.3`	Not reported	UBUNTU-CVE-2020-8927	Not reported
Ubuntu	brotli	deb	20.04	`1.0.7-6ubuntu0.1`	Not reported	UBUNTU-CVE-2020-8927	Not reported
Ubuntu	brotli	deb	16.04	`1.0.3-1ubuntu1~16.04.2`	Not reported	USN-4568-1	Not reported
Ubuntu	brotli	deb	18.04	`1.0.3-1ubuntu1.3`	Not reported	USN-4568-1	Not reported
Ubuntu	brotli	deb	20.04	`1.0.7-6ubuntu0.1`	Not reported	USN-4568-1	Not reported
Opensuse	brotli	rpm	leap 15.2	`1.0.9-lp152.2.3.1`	Not reported	OPENSUSE-SU-2020:1578-1	Not reported
Suse	brotli	rpm	linux enterprise micro 5.1	`1.0.7-3.3.1`	Not reported	SUSE-SU-2025:01762-1	Not reported
Suse	brotli	rpm	linux enterprise module for basesystem 15 sp2	`1.0.7-3.3.1`	Not reported	SUSE-SU-2021:3942-1	Not reported
Suse	brotli	rpm	linux enterprise module for basesystem 15 sp3	`1.0.7-3.3.1`	Not reported	SUSE-SU-2021:3942-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 15 sp3	`0.7.0-150300.3.3.1`	Not reported	SUSE-SU-2023:3827-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 15 sp4	`0.7.0-150300.3.3.1`	Not reported	SUSE-SU-2023:3827-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 15 sp5	`0.7.0-150300.3.3.1`	Not reported	SUSE-SU-2023:3827-1	Not reported
Opensuse	python-brotlipy	rpm	leap 15.4	`0.7.0-150300.3.3.1`	Not reported	SUSE-SU-2023:3827-1	Not reported
Opensuse	python-brotlipy	rpm	leap 15.5	`0.7.0-150300.3.3.1`	Not reported	SUSE-SU-2023:3827-1	Not reported
Suse	python-Brotli	rpm	linux enterprise module for python 3 15 sp6	`1.0.7-150200.3.3.1`	Not reported	SUSE-SU-2024:1968-1	Not reported
Suse	python-Brotli	rpm	linux enterprise module for server applications 15 sp5	`1.0.7-150200.3.3.1`	Not reported	SUSE-SU-2024:1968-1	Not reported
Opensuse	python-Brotli	rpm	leap 15.5	`1.0.7-150200.3.3.1`	Not reported	SUSE-SU-2024:1968-1	Not reported
Opensuse	cargo-audit-advisory-db	rpm	tumbleweed	`20220105-1.1`	Not reported	OPENSUSE-SU-2024:11708-1	Not reported
Opensuse	brotli	rpm	leap 15.3	`1.0.7-3.3.1`	Not reported	OPENSUSE-SU-2021:3942-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 12	`0.6.0-2.6.1`	Not reported	SUSE-SU-2023:3670-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 15 sp1	`0.7.0-150100.3.6.1`	Not reported	SUSE-SU-2023:3669-1	Not reported
Suse	python-brotlipy	rpm	linux enterprise module for public cloud 15 sp2	`0.7.0-150100.3.6.1`	Not reported	SUSE-SU-2023:3669-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[brotli]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[libbrotli1]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[libbrotli-dev]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[python3-brotli]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12

[Debian 13 (Trixie)]

[brotli]Unknown
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
[libbrotli1]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
[libbrotli-dev]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
[python3-brotli]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 1.0.9-1
  dsa · brotli · debian · 13

[openSUSE Tumbleweed]

[cargo-audit-advisory-db]Unknown
Source package: [cargo-audit-advisory-db]
Details (1)
- 20260813-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 20220105-1.1
  dsa · cargo-audit-advisory-db · opensuse · tumbleweed
[python313-Brotli]Unknown
Source package: [python-Brotli]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 1.2.0-1.6
  Version impact unknown
  dsa · python-Brotli · opensuse · tumbleweed
[python314-Brotli]Unknown
Source package: [python-Brotli]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 1.2.0-1.6
  Version impact unknown
  dsa · python-Brotli · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:53:38 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]