Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64
  4. ›
  5. CVE-2020-8927

CVE-2020-8927: Integer overflow in the bundled Brotli C library

May 24, 2022 (updated September 16, 2024)

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a “one-shot” decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the “streaming” API as opposed to the “one-shot” API, and impose chunk size limits.

References

  • github.com/advisories/GHSA-5v8v-66v8-mwm7
  • github.com/bitemyapp/brotli2-rs
  • github.com/bitemyapp/brotli2-rs/issues/45
  • github.com/github/advisory-database/issues/785
  • github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6
  • github.com/google/brotli/releases/tag/v1.0.8
  • github.com/google/brotli/releases/tag/v1.0.9
  • github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2020-29.yaml
  • lists.debian.org/debian-lts-announce/2020/12/msg00003.html
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG
  • nvd.nist.gov/vuln/detail/CVE-2020-8927
  • rustsec.org/advisories/RUSTSEC-2021-0131.html
  • rustsec.org/advisories/RUSTSEC-2021-0132.html
  • usn.ubuntu.com/4568-1
  • www.debian.org/security/2020/dsa-4801

Code Behaviors & Features

Detect and mitigate CVE-2020-8927 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions starting from 5.0.0 before 5.0.15, all versions starting from 6.0.0 before 6.0.3

Fixed versions

  • 5.0.15
  • 6.0.3

Solution

Upgrade to versions 5.0.15, 6.0.3 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Source file

nuget/Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64/CVE-2020-8927.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:24 +0000.