Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

brotli

4 known vulnerabilities (2 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
1.2.1 (Oct 22, 2026): no advisory affects it
Newest unaffected release
1.2.1 (Oct 22, 2026), the latest release
Advisories
4 · 2 critical, 1 high, 1 medium
Weekly downloads
28.4M
Dependents
5,832
Releases
11 since 0.5.2 (Oct 12, 2016)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • CVE-2026-111497Critical 9.2 · KEV

    Out-of-Bounds Write in Google Brotli Decoder

    Affected: fixed in 1.2.1; from 1.0.3, fixed in 1.2.1.

    Fixed in 1.2.1 (released Oct 22, 2026, the day of disclosure).

    The latest release, 1.2.1, is not affected.

  • Brotli decompression bomb DoS in scrapy/scrapy

    Affected: fixed in 1.2.0.

    Fixed in 1.2.0 (released Nov 5, 2025, 5 days after disclosure).

    The latest release, 1.2.1, is not affected.

  • CVE-2020-36846Critical 9.8

    IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

    Affected: fixed in 1.0.8.

    Fixed in 1.0.8 (released Aug 27, 2020, 1737 days before disclosure).

    The latest release, 1.2.1, is not affected.

  • CVE-2020-8927Medium 5.3

    Buffer overflow in Brotli library

    Affected: fixed in 1.0.8.

    Fixed in 1.0.8 (released Aug 27, 2020, 19 days before disclosure).

    The latest release, 1.2.1, is not affected.