| Package | Affected versions | Patched versions |
|---|---|---|
| brotli | < 1.0.8 | 1.0.8 |
| .net | ≥ 5.0, ≤ 5.0.14 | |
| .net core | ≥ 3.1, ≤ 3.1.22 | |
| powershell | ≥ 7.0, < 7.0.9≥ 7.1, < 7.1.6≥ 7.2, < 7.2.2 | 7.0.97.1.67.2.2 |
| visual studio 2019 | ≥ 16.0, ≤ 16.11 | |
| visual studio 2022 | = 17.1≥ 17.0, ≤ 17.0.7 |
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free