-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service in the Brotli Python library's decompression functionality. Specifically, when decompressing a specially crafted data stream (a "decompression bomb"), the library could be forced to allocate an extremely large amount of memory, leading to a crash. This is because the decompression functions did not enforce a limit on the size of the output data.
The analysis of the patch commit 67d78bc41db1a0d03f2e763497748f2f69946627 reveals the exact location of the vulnerability and the fix.
The core changes are in python/_brotli.c:
Streaming Decompression: The brotli.Decompressor object's process method (implemented by the C function brotli_Decompressor_process) was vulnerable. The original implementation would call a C helper function decompress_stream which continuously grew an output buffer (BlocksOutputBuffer) without any upper bound. An attacker could provide a small input that decompresses to a huge size, exhausting system memory. The patch introduces a max_output_length parameter to the process method. This limit is then enforced within the modified C functions (decompress_stream, BlocksOutputBuffer_Grow) to prevent excessive memory allocation. The vulnerable function is the process method before this limit was introduced.
One-shot Decompression: The brotli.decompress function was also modified. While the patch focuses on the streaming decompressor, the one-shot function also used the same unbounded buffer growth logic. The patch modifies the call to BlocksOutputBuffer_InitAndGrow to pass PY_SSIZE_T_MAX as a limit. While this still allows for very large allocations, it's a change related to the vulnerability. The primary vulnerable function is the streaming process method, as it's more susceptible to attacks where the final output size is unknown.
Therefore, the key function that would appear in a runtime profile during exploitation is Decompressor.process. The decompress function is also a potential indicator.
Decompressor.processpython/_brotli.c
decompresspython/_brotli.c
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| brotli | pip | <= 1.1.0 |
Ongoing coverage of React2Shell