GHSA-2v8p-fqpx-2q3w

Summary

jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)

Severity

medium

CVSS

6.2

CWE

CWE-190

Published

2026-07-02

Updated

2026-07-02

Advisory details

Summary

Logic bug in decode_simple_table_slow may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with overflow-checks enabled.

Impact

Denial of service: any application passing untrusted JXL data to JxlImage::render_frame (or equivalent) can be crashed. Affects all builds with overflow checks enabled, which includes debug builds and any release build that sets overflow-checks = true in Cargo.toml or [profile.*].

No memory corruption is possible — the panic fires before any unsafe code is reached.

References

• https://github.com/advisories/GHSA-2v8p-fqpx-2q3w
• https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-2v8p-fqpx-2q3w

Related advisories

• CVE-2026-54755 — critical · Go/github.com/klever-io/klever-go
• CVE-2026-71479 — critical · Go/github.com/QuantumNous/new-api
• CVE-2026-39834 — critical · Go/golang.org/x/crypto/ssh
• WEB3-CETUS-SUI-2025 — critical · Web3 · Sui/Cetus Protocol (integer-mate)
• WEB3-CETUS-2025 — critical · Web3 · Sui/Cetus Protocol
• WEB3-VELOCORE-2024 — critical · Web3 · Linea/Velocore
• WEB3-KYBERSWAP-2023 — critical · Web3 · Ethereum/KyberSwap Elastic
• CVE-2018-10299 — critical · Web3 · Ethereum/Beauty Ecosystem Coin (BEC)

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity