IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder.

Affected versions compile a bundled brotli into the module rather than linking to the system library. The bundled copy, 1.0.4 through 1.2.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 0.023 updates it to brotli 1.2.1.

Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.