#1144283 libostree-1-1:amd64: regression in flatpak after fixing GHSA-7cgc-gp99-6jmm: Decompressed delta part exceeds configured limit

Package:
libostree-1-1
Source:
libostree-1-1
Description:
content-addressed filesystem for operating system binaries (library)
Submitter:
Simon McVittie
Date:
2026-08-20 19:53:02 UTC
Severity:
normal
Tags:
#1144283#5
Date:
2026-08-13 09:46:14 UTC
From:
To:
After updating ostree to 2026.3 (fixing denial-of-service issue
GHSA-7cgc-gp99-6jmm), some Flatpak users are reporting that updating
apps from Flathub fails:

Let's not let this migrate to testing until a fix is available.

I am unlikely to be able to fix this myself without re-introducing the
DoS issue, so I would appreciate help from anyone who understands
libostree's download protocol better than I do.

    smcv
#1144283#14
Date:
2026-08-20 19:42:58 UTC
From:
To:
Hello,

Bug #1144283 in ostree reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/ostree/-/commit/d69cb6beb48218b7f02651506c0ffa9580cb7ebe
------------------------------------------------------------------------
New upstream release

Closes: #1144283
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1144283
#1144283#21
Date:
2026-08-20 19:51:18 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
ostree, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144283@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated ostree package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 20 Aug 2026 20:16:44 +0100
Source: ostree
Architecture: source
Version: 2026.4-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1144283
Changes:
 ostree (2026.4-1) unstable; urgency=medium
 .
   * New upstream release
     - Fix regression when downloading large Flatpak apps/runtimes
       (reopens: #1144105) (Closes: #1144283)
   * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch:
     Add post-release patch to fix offset validation.
     This was an out-of-bounds read when downloading from a
     malicious/crafted ostree repository, but is not believed to
     be practically exploitable for anything worse than a crash
     (denial-of-service).
   * Mention #1144105, #1144106 in previous changelog entry
Checksums-Sha1:
 07c6c9a404da2898f100a5759e3a6699c928f2c8 3659 ostree_2026.4-1.dsc
 be31484d5c00353b6c3d966750c83eb44a8a53d0 2141564 ostree_2026.4.orig.tar.xz
 12b48ff7d96c87988c7876e2091b92a61c961927 32388 ostree_2026.4-1.debian.tar.xz
 c92fa07d27f72b9b4447340ff03c6c141cd597f9 4404808 ostree_2026.4-1.git.tar.xz
 eaec49b59524ecf5d5b322673d96a740bbccf948 17660 ostree_2026.4-1_source.buildinfo
Checksums-Sha256:
 fe860de2bd97e6cb51964238cab33b680905edaeed3d5dd21b813e71c3fe19f8 3659 ostree_2026.4-1.dsc
 b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7 2141564 ostree_2026.4.orig.tar.xz
 88138ea5ab0c0a8dfa5e0eea991ef308e5f70b44f3b2ce10f4bf6c93e1d35d38 32388 ostree_2026.4-1.debian.tar.xz
 82c6e8eacbc3d6a9f15cd566dd667acf455dd6a5cc12790efdb9bdf6bf2af954 4404808 ostree_2026.4-1.git.tar.xz
 ffdb7973926bf001b20ce5dca311bf10ce007023652c8d41b8ab08d1d309132d 17660 ostree_2026.4-1_source.buildinfo
Files:
 f23b4b366843ad133268cf2091b81d6f 3659 admin optional ostree_2026.4-1.dsc
 22d3422529c07eef716fea8a6c9b0c2b 2141564 admin optional ostree_2026.4.orig.tar.xz
 d880d033e7125ecb69e7b8e8fbb6522d 32388 admin optional ostree_2026.4-1.debian.tar.xz
 7389dee2cf3f871f1e2fb656b786791b 4404808 admin None ostree_2026.4-1.git.tar.xz
 17d23b44b3169c15b74c4b36172498ba 17660 admin optional ostree_2026.4-1_source.buildinfo
Git-Tag-Info: tag=5b299e2d91e6d04ca690a674004237f6127aa26f fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <smcv@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqHVmMACgkQYG0ITkaD
wHnBgQ//Q9BXJf4onNGDNZb1LxLc1HQob5wDZ0gN23VuSr5qX1cbxaIO0+AO/d+j
Ngl5zWr4cuuSjHcVCwHcrx35Oss5zY6A8COOkqq8UIoVRK6mzsPh4hXqTuMw1rEX
f6uqN0MgXfT0Z4/CSvFC4csWjCYqerFGEe1ZgONUzULulIlWPXkPsXQlUBR4G7NY
SXZ+beXI2yDGmbqfbMLPogLaG63k7dmkfggbu1UxRfOECu9jntkJyQiDyb/tdYRZ
l++ss9T/HMPti2q5RXb1bljRP9db+Nu3cZqJYhyo3EVRk34D7SxDUMa3MDtvzM2Q
zrOfKQAOaNoXMbsw6u8wyF8yT3xqTzYd8OtB7jyQKF1bMM13aXNLVNEW23RxCAot
8fdkD2ajtr1TeCv4MNbiICeNw+9i0+G2b4xE7pT7k4F0K4hWEiCtlI47goKVmtZW
/2HsNetjPc7d+Ze+Ohv9Emp1HSh+lw5zzW6NHOXUTU5vdMYHO52voiNYZeUtYuLX
wZt7+XJNLFkD6EqPETM5QtFtCSK2tVJkYAlF1mEYFk/IQjh0azXsbAso2dwMRQV4
vhl6Oeb+el4DyMDk4AkUcaTo57Szj+k2+Db7sClUpnkPJ93asbEfwv9hAHRYW5Kv
XGhWwqyjbIAxcl6poV/Lev2CrQQIdhZnPGwVvzqjziKYXO/Cef0=
=nvHM
-----END PGP SIGNATURE-----