Hi,

The following vulnerability was published for simdjson.

CVE-2026-88358[0]:
| simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability
| in dom::parser::parse_unpadded(). A specially crafted truncated JSON
| document whose final structural token closes a nested array or
| object can cause json_iterator::walk_document() to access buf[len]
| after the input buffer has been exhausted. This results in a heap
| out-of-bounds read and may cause application termination, leading to
| denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88358
https://www.cve.org/CVERecord?id=CVE-2026-88358
[1] https://github.com/simdjson/simdjson/issues/2815
[2] https://github.com/simdjson/simdjson/pull/2817
[3] https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Le sam. 26 sept. 2026 à 13:43, Salvatore Bonaccorso <carnil@debian.org> a
écrit :

It's weird that they fixed it, made releases after, without the fix :(