brotli is vulnerable to denial of service. A buffer overflow vulnerability exists where an attacker can crash the application by controlling the input length of a one-shot
decompression request to a script. This happens when copying over chunks of data larger than 2 GiB.
lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html
github.com/google/brotli/releases/tag/v1.0.9
lists.debian.org/debian-lts-announce/2020/12/msg00003.html
lists.fedoraproject.org/archives/list/[email protected]/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/
lists.fedoraproject.org/archives/list/[email protected]/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/
lists.fedoraproject.org/archives/list/[email protected]/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/
lists.fedoraproject.org/archives/list/[email protected]/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/
lists.fedoraproject.org/archives/list/[email protected]/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/
lists.fedoraproject.org/archives/list/[email protected]/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/
lists.fedoraproject.org/archives/list/[email protected]/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/
lists.fedoraproject.org/archives/list/[email protected]/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/
lists.fedoraproject.org/archives/list/[email protected]/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/
usn.ubuntu.com/4568-1/
www.debian.org/security/2020/dsa-4801