Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-5v8v-66v8-mwm7

Integer overflow in the bundled Brotli C library

CVSS 5.3 MediumEPSS 0.032 · 88th percentile

Published by the GitHub Advisory Database at 24 May 2022, 17:28 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
compu-brotli-syscrates.io<1.0.91.0.9
Microsoft.NETCore.App.Runtime.linux-armNuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-arm64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-x64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.osx-x64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-armNuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-arm64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x64NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x86NuGet>=3.0.0, <3.1.23 || >=5.0.0, <5.0.15 || >=6.0.0, <6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-armNuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-arm64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.browser-wasmNuGet>=5.0.0, <5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet>=5.0.0, <5.0.15 || >=6.0.0, <6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasmNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasmNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasmNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasmNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-armNuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x64NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x86NuGet>=6.0.0, <6.0.36.0.3
Microsoft.NETCore.App.Runtime.osx-arm64NuGet>=6.0.0, <6.0.36.0.3
brotliPyPI<1.0.81.0.8
Identifiers
GHSA-5v8v-66v8-mwm7 · BIT-brotli-2020-8927 · BIT-dotnet-2020-8927 · BIT-dotnet-sdk-2020-8927 · BIT-powershell-2020-8927 · CVE-2020-36846 · CVE-2020-8927 · GO-2025-3726 · PYSEC-2020-29 · RUSTSEC-2021-0131 · RUSTSEC-2021-0132
Weakness (CWE)
CWE-120 · CWE-130 · CWE-1395
Tags
Published
24 May 2022
Updated
10 Sept 2026

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
5.3 Medium 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CNA (Google)
  • CISA KEV Not listed.
  • EPSS 0.032, the 88th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:37 UTC First seen by agentprime
  2. 31 Oct 2026, 14:37 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.