It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
Another day another out of bounds access in C code.