It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
This is the fix commit https://github.com/google/brotli/commit/b418fa81c48262a86a95...
Another day another out of bounds access in C code.
loading story #50218015