Cyber ·
CVE-2026-115936: out-of-bounds write in the Brotli decoder of IO::Compress::Brotli (Perl)
CPAN Security Group advisory on an out-of-bounds write in the Brotli library bundled with IO::Compress::Brotli. Versions from 0.004001 up to but not including 0.023 are affected.
Advisory CVE-2026-115936 describes an out-of-bounds write in the Brotli decoder bundled with IO::Compress::Brotli, a Perl module. According to the text, versions before 0.023 include a Brotli library with this problem. The affected distribution is IO-Compress-Brotli, with versions from 0.004001 up to but not including 0.023. It was published on 23 October 2026 in the oss-sec feed by Timothy Legge, on behalf of the CPAN Security Group. The available text is an automatic translation of the original content.
What the advisory does not provide in the available text: exploitation details, severity scoring or specific impact. For those, consult the original source. To verify scope, check the version list and the distribution record on MetaCPAN at the official source. In Perl environments, the installed version can be read with the interpreter itself, using the module's version variable.
Relevance for organizations: if the module is in use, the action indicated by the advisory is to upgrade to version 0.023 or later. This content does not involve a Rota Nacional feature, and the platform does not patch third-party libraries.
If your team uses AI to study the advisory or plan the fix, do not paste production code, logs or personal data. Rota Nacional detects CPF, CNPJ, e-mail, phone and names before any model runs and applies the policy the organization chooses, but protection starts with what the team decides to send.