{"id":"GHSA-2v8p-fqpx-2q3w","title":"jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)","summary":"jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)","severity":"medium","cvss":6.2,"cwe":["CWE-190"],"vendor":"jxl-modular","product":"jxl-modular","ecosystem":"rust","affected":["jxl-modular <= 0.11.2"],"patched":["jxl-modular 0.11.3"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2v8p-fqpx-2q3w","references":[{"url":"https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-2v8p-fqpx-2q3w"},{"url":"https://github.com/advisories/GHSA-2v8p-fqpx-2q3w"}],"tags":["ghsa","rust"],"ingestedAt":"2026-07-02T21:44:45.102Z","slug":"GHSA-2v8p-fqpx-2q3w","body":"## Overview\n\n### Summary\nLogic bug in `decode_simple_table_slow` may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with `overflow-checks` enabled.\n\n### Impact\nDenial of service: any application passing untrusted JXL data to `JxlImage::render_frame` (or equivalent) can be\ncrashed. Affects all builds with overflow checks enabled, which includes debug builds and any release build\nthat sets `overflow-checks = true` in Cargo.toml or `[profile.*]`.\n\nNo memory corruption is possible — the panic fires before any unsafe code is reached.\n\n## Affected packages\n\n- `jxl-modular <= 0.11.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jxl-modular 0.11.3`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}