A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0031.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Google LLC Brotli affected
Version Status Constraints
stable affected ≤ 1.0.7

Configuration 1 [-]

cpe:2.3:a:google:brotli:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Configuration 5 [-]

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:17.1:*:*:*:*:*:*:*
Package CPE Advisory Released Date
.NET Core on Red Hat Enterprise Linux
rh-dotnet31-dotnet-0:3.1.417-1.el7_9 cpe:/a:redhat:rhel_dotnet:3.1::el7 RHSA-2022:0829 2022-03-10T00:00:00Z
rh-dotnet50-dotnet-0:5.0.212-1.el7_9 cpe:/a:redhat:rhel_dotnet:5.0::el7 RHSA-2022:0828 2022-03-10T00:00:00Z
Red Hat Enterprise Linux 8
brotli-0:1.0.6-3.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2021:1702 2021-05-18T00:00:00Z
dotnet3.1-0:3.1.417-1.el8_5 cpe:/a:redhat:enterprise_linux:8 RHSA-2022:0827 2022-03-10T00:00:00Z
dotnet5.0-0:5.0.212-1.el8_5 cpe:/a:redhat:enterprise_linux:8 RHSA-2022:0830 2022-03-10T00:00:00Z
brotli-0:1.0.6-3.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2021:1702 2021-05-18T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Google Subscribe
Brotli Subscribe
Microsoft Subscribe
.net Subscribe
.net Core Subscribe
Powershell Subscribe
Visual Studio 2019 Subscribe
Visual Studio 2022 Subscribe
Opensuse Subscribe
Leap Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Rhel Dotnet Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2476-1 brotli security update
Debian DSA Debian DSA DSA-4801-1 brotli security update
EUVD EUVD EUVD-2020-0057 A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.
Github GHSA Github GHSA GHSA-5v8v-66v8-mwm7 Integer overflow in the bundled Brotli C library
Ubuntu USN Ubuntu USN USN-4568-1 Brotli vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html cve-icon cve-icon
https://github.com/google/brotli/releases/tag/v1.0.9 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-8927 cve-icon
https://usn.ubuntu.com/4568-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-8927 cve-icon
https://www.debian.org/security/2020/dsa-4801 cve-icon cve-icon
History

Fri, 29 May 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Google

Published:

Updated: 2026-05-29T20:52:34.416Z

Reserved: 2020-02-12T00:00:00.000Z

Link: CVE-2020-8927

cve-icon Vulnrichment

Updated: 2024-08-04T10:12:11.066Z

cve-icon NVD

Status : Modified

Published: 2020-09-15T10:15:12.887

Modified: 2024-11-21T05:39:41.370

Link: CVE-2020-8927

cve-icon Redhat

Severity : Important

Publid Date: 2020-08-27T00:00:00Z

Links: CVE-2020-8927 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses