Hi,

The following vulnerability was published for rlottie.

CVE-2026-19587[0]:
| Uncontrolled Resource Consumption vulnerability in Samsung Open
| Source rlottie allows Excessive Allocation.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19587
https://www.cve.org/CVERecord?id=CVE-2026-19587
[1] https://github.com/Samsung/rlottie/pull/599
[2] https://github.com/Samsung/rlottie/commit/34465a9e93c38af9a5287ad28400bb932c1a2a92

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

As far as I can see, those merge requests, in particular, limit the maximal
number of processed layers. However, the commits from there do not apply
cleanly due to refactoring in version 0.2 and due to other patches addressing
similar issues. I dare assume that CVE-2026-18772 and CVE-2026-19587 were fixed
by Debian-specific patches, No-cyclic-layers.patch (first appeared in version
0~git20200305.a717479+dfsg-1) and by No-cyclic-structures.patch (from version
0.1+dfsg-4).

https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-layers.patch
https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-structures.patch