-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing bounds checks when handling compressed data lengths. All patched files added explicit checks for negative lengths/offsets caused by integer overflow (e.g., literalLength < 0). The functions directly process untrusted input using sun.misc.Unsafe for memory operations, and the absence of these checks allowed: 1) OOB reads/writes via negative lengths wrapping to large positive values, 2) Access to memory outside allocated buffers. The commit diffs show these functions were modified to add MalformedInputException throws precisely where length validation was missing, confirming their vulnerable status.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.airlift:aircompressor | maven | < 0.27 | 0.27 |
JavaJavaOngoing coverage of React2Shell