【中危】jxl-oxide：拒绝服务风险（GHSA-66m8-c62j-h6v5）

安全情报快照 · 风险级别：中危 · CVSS：6.2 · GHSA-66m8-c62j-h6v5

先看结论

jxl-oxide存在拒绝服务风险，<= 0.12.5 受影响，建议升级至 0.12.6。

影响范围

生态	组件	受影响版本	首个修复版本
rust	`jxl-oxide`	<= 0.12.5	0.12.6

处置建议

优先将 jxl-oxide 升级至 0.12.6 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.

Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within jxl-oxide.

Impact

On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。