News Summary

• A memory-corruption flaw in Google's Brotli decoder sits in many programs.
• The flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory.
• No real-world attacks have been reported.
• The bug is in the C code that unpacks aBrotli stream, so it travels into anything that reuses that code, from language runtimes to proxies to Python packages.
• It was first disclosed on October 21, when Node.js and Google shipped fixes.