CVE-2020-8927

Name of the Vulnerable Software and Affected Versions: Brotli library versions prior to 1.0.8

Description: A buffer overflow exists in the Brotli library where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. This issue can be exploited by a remote attacker to disrupt data integrity and cause a denial of service.

Recommendations: To resolve the issue, update the Brotli library to 1.0.8 or later. If updating is not possible, use the "streaming" API instead of the "one-shot" API and impose chunk size limits. For Rust users, migrate to the brotli crate, which provides a Rust implementation of Brotli compression and decompression that is not affected by this issue.