Hi,

The following vulnerability was published for c-blosc2.

CVE-2026-103222[0]:
| A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This
| impacts the function blosclz_decompress of the file blosc/blosclz.c
| of the component blosclz Decompression. Executing a manipulation can
| lead to integer overflow. The attack may be launched remotely. A
| high complexity level is associated with this attack. The
| exploitability is said to be difficult. Upgrading to version 3.3.3
| will fix this issue. This patch is called
| fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component
| should be upgraded.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103222
https://www.cve.org/CVERecord?id=CVE-2026-103222
[1] https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
c-blosc2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149701@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Antonio Valentino <antonio.valentino@tiscali.it> (supplier of updated c-blosc2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 09 Oct 2026 06:22:05 +0000
Source: c-blosc2
Architecture: source
Version: 3.3.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Antonio Valentino <antonio.valentino@tiscali.it>
Closes: 1149701
Changes:
 c-blosc2 (3.3.5-1) unstable; urgency=medium
 .
   * Upload to unstable (Closes: #1149701).
Checksums-Sha1:
 20380af6a6ee08ea348927a172c2c49335c35e94 3324 c-blosc2_3.3.5-1.dsc
 7a767f90d09d822ca49ceff32e64eaaf038139dd 8796 c-blosc2_3.3.5-1.debian.tar.xz
 57f26d40a512bfb4563bc71bbcbe9efd95479e63 9962 c-blosc2_3.3.5-1_source.buildinfo
Checksums-Sha256:
 b5700d01938c2f7c7c6909e58e62fe8d99c4bafe3d439de9a61cb23d4e8ff34d 3324 c-blosc2_3.3.5-1.dsc
 eb0af6380a26fae1f44850e25e2164f3986ee0a9fea8794fa582caf85228d619 8796 c-blosc2_3.3.5-1.debian.tar.xz
 f9630016b954c3ba8807cb029f7aa3cb56db5300fa9c0ebd976676b163e0112a 9962 c-blosc2_3.3.5-1_source.buildinfo
Files:
 6e6d97ce186ea54d2fac19066f821cd5 3324 libs optional c-blosc2_3.3.5-1.dsc
 31fc0098a770873af8e2e6ce61c7792a 8796 libs optional c-blosc2_3.3.5-1.debian.tar.xz
 0a15a439604ecd21ca755408ff64e06b 9962 libs optional c-blosc2_3.3.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJRBAEBCgA7FiEEO3DyCaX/1okDxHLF6/SKslePmBIFAmrI8cMdHGFudG9uaW8u
dmFsZW50aW5vQHRpc2NhbGkuaXQACgkQ6/SKslePmBJFbRAAlTeRnQtzxuOizGBS
DTlxgmH3j3PVfpR95NSwi7uUJI5Xggp/WxmBgLsbFX8rE7hTfZ2tbPvoWVfIxAUr
qfNueXD7j1KIBKKzHgbmRrf8iaXoVIx2CAkwaFnAhci8+MIhgeGAs+BHUTB5cLy0
SiQzXvKktLQOcjrMo8zsIhKomJaBWAF2Fux9w8xQNI3FJ1O1hQeYZLXjRENdM2oa
aIqZ6V7v+vxTH+tkGBZWRCrKJjZIXhibdCezxNfw5Ds4qqBNith6LeeEIt1+mzik
e+Ceiu9wiS6TNryO+h4nmGKhbPDodPPLa30NsL7KOUgVEEA11t94PE6YjmYhfY59
2O/mNO077fXmjPahKcyYKeU80Tc4WyUQuiX9P86Mkizhq60e/XKD6YNTMdVLS4dq
Bkok1bTYfF70kz22Ux99Q5b4yhINoBrAApkH9Z0uRRSNZo90D0iKTZFgJFvmu9il
DPcQqOzOGvQqOBo+Ut23Kbp2xPJQEqQcQ5zJsCzCNUpL4bNzHIDjG2Pz1J2SCzA2
Ki949hoeaMTj7yLyo0u2JGoFuErrkLB4ACvTwPzmx+lhihkElCYtYnL2i4F+f8qx
Oob5Fd+hM7PJrUyfzCBckNc6qLaclAkX8SFeKDYMDtQCM2rOfNvpmHVPa1/5zfF5
hpz1pNUjb/7DRjAGkSyPX/VApds=
=vd5p
-----END PGP SIGNATURE-----