Rust advisories / brotli-sys
Vulnerability MediumRUSTSEC-2021-0131 · brotli-sys
RUSTSEC-2021-0131: Integer overflow in the bundled Brotli C library
Short answerA security vulnerability in the brotli-sys crate: Integer overflow in the bundled Brotli C library. GitHub rates it Medium. No fixed version: replace the crate or remove the affected code path.
| Crate | brotli-sys |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2021-12-20 |
| Last changed | 2025-09-04 |
| Also known as | BIT-brotli-2020-8927, BIT-dotnet-2020-8927, BIT-dotnet-sdk-2020-8927, BIT-powershell-2020-8927, CVE-2020-36846, CVE-2020-8927, GHSA-5v8v-66v8-mwm7, GO-2025-3726, PYSEC-2020-29, RUSTSEC-2021-0132 |
What to do
- Find who pulls it in:
cargo tree -i brotli-sys. - Avoid the affected API, or replace the crate.
Details from the advisory
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB.
An updated version of brotli-sys has not been released. If one cannot update the C library, its authors recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
In Rust the issue can be mitigated by migrating to the brotli crate, which provides a Rust implementation of Brotli compression and decompression that is not affected by this issue.
References
- Package: crates.io/crates/brotli-sys
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0131.html
- Report: github.com/bitemyapp/brotli2-rs/issues/45
- Web: github.com/google/brotli/releases/tag/v1.0.9
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?