GHSA-2v8p-fqpx-2q3w: jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)

July 2, 2026

Logic bug in decode_simple_table_slow may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with overflow-checks enabled.

References

github.com/advisories/GHSA-2v8p-fqpx-2q3w
github.com/tirr-c/jxl-oxide/security/advisories/GHSA-2v8p-fqpx-2q3w

Code Behaviors & Features

Detect and mitigate GHSA-2v8p-fqpx-2q3w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →