Perl XS::libbrotli Bundled Library Out-of-Bounds Write Vulnerability (CVE-2026-115946)
Executive & SecOps Summary
SECOPS ASSESSMENTPerl XS::libbrotli modules before version 1.2.1.0 and dependent XS modules statically linked against them
Memory corruption, process crash, information disclosure, or potential Remote Code Execution (RCE) via crafted Brotli streams
Upgrade XS::libbrotli to version 1.2.1.0 or later, and rebuild all dependent Perl XS modules
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade the XS::libbrotli module to version 1.2.1.0 or higher using CPAN, and force a rebuild of all dependent modules.
# Upgrade XS::libbrotli to the patched version via cpanm
cpanm --force XS::libbrotli@1.2.1.0
# Alternatively, use the standard CPAN shell
perl -MCPAN -e 'install XS::libbrotli'2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure reverse proxies or Web Application Firewalls (WAFs) to reject incoming requests containing Brotli compression (Content-Encoding: br).
# Example Nginx configuration to block Brotli-encoded requests
if ($http_content_encoding ~* 'br') {
return 415 'Unsupported Media Type: Brotli decompression is temporarily disabled';
}3. Log Audit & IoC Verification Commands
Run the following commands to verify the installed version of XS::libbrotli and identify potentially vulnerable static links.
# Check the currently installed XS::libbrotli version
perl -MXS::libbrotli -e 'print "XS::libbrotli version: ", $XS::libbrotli::VERSION, "\
"'
# Scan for static libraries or shared objects referencing Brotli symbols
find /usr/local/lib* /usr/lib* -name '*.so' -o -name '*.a' 2>/dev/null | xargs grep -l 'brotli' 2>/dev/nullScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
The vulnerability exists in the Perl XS::libbrotli module, which bundles vulnerable source code of the Brotli library (versions 1.0.7 or 1.1.0) and compiles it into static archives rather than linking against the system-wide shared library. Consequently, upgrading the system-level Brotli library does not remediate this flaw. The bundled decoder contains an out-of-bounds write vulnerability tracked under CVE-2026-111497.
2. Exploitation Mechanics & Attack Scenario
Although XS::libbrotli does not expose a direct Perl interface, the vulnerable decoder is reached through any dependent Perl module that decompresses untrusted data using this library. An attacker can supply a specially crafted Brotli-compressed stream to an application. When the application attempts to decompress the payload, it triggers an out-of-bounds write in the decoder, corrupting the heap memory state. This can lead to a denial-of-service (DoS) crash, memory disclosure, or arbitrary code execution.
3. Infrastructure & Business Impact
Any Perl-based backend services, API gateways, or web applications processing compressed user input are highly vulnerable. Because the vulnerability is embedded within statically linked binaries, standard container or OS-level package updates will fail to patch it, potentially leaving production environments exposed to persistent compromise and data exfiltration.
Official Vendor Advisories & References
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.
Frequently Asked SecOps Questions (CVE-2026-115946)
FAQQ1. How critical is CVE-2026-115946 and is it actively exploited in the wild?
CVE-2026-115946 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-115946?
Primary impacted vendors include syber across xs-libbrotli. Scope summary: All versions of XS::libbrotli prior to 1.2.1.0 (bundling Brotli 1.0.7 or 1.1.0)
Q3. What temporary mitigations or workarounds exist for CVE-2026-115946 before patching?
[Mitigation] Upgrade XS::libbrotli to version 1.2.1.0 or later, and rebuild all dependent Perl XS modules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-115946
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (syber)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.