github.comadvisoryBrotli vulnerability affects curl and Git
GHSA-9v8h-qqgm-4m35 is a critical buffer overflow (CVSS v4 9.2) in the Google Brotli decoder (c/dec/decode.c), affecting versions 1.0.3 through 1.2.0 on all platforms. A crafted compressed stream lets an unauthenticated remote attacker corrupt adjacent decoder state, leak memory, crash the process, or possibly execute code. Fixed in 1.0.10, 1.1.1 and 1.2.1. The page does not mention curl or Git, despite the title.
TL;DR Critical Brotli decoder buffer overflow in 1.0.3 to 1.2.0 allows memory disclosure, DoS and possible code execution via a crafted stream.
Organisations named here
- GHSA-9v8h-qqgm-4m35
Technologies named here
- CVSS v4
- GitHub Advisory Database
- National Vulnerability Database
- Brotli
- CVSS
- NVD
Techniques named here
- Impacts
- Weakness class noted
- Buffer overflow
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup