https://bugzilla.redhat.com/show_bug.cgi?id=2494722
Bug ID: 2494722
Summary: CVE-2026-56017 perl-JavaScript-Minifier-XS:
JavaScript::Minifier::XS: Denial of Service via NULL
pointer dereference with crafted input [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["ab23247a-ed04-4b4f-a1e4-e6dbaa609efc"]}
Component: perl-JavaScript-Minifier-XS
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected],
[email protected]
Blocks: 2494682
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL
pointer dereference when the first meaningful token of the input is a slash.
The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects
the previous token's last byte to choose between a regexp literal and a
division operator. When a slash is the first meaningful token, with the start
of input or only whitespace and comments before it, there is no valid preceding
token: the walk back over whitespace and comment nodes runs off the head of the
node list to NULL, and the byte lookup reads through a NULL contents pointer at
an underflowed length index. The following identifier check dereferences the
same NULL pointer.
The crash is reachable through the public minify() API, so input as small as a
single slash byte crashes the calling process. A service that minifies
untrusted or third-party JavaScript can be crashed by a remote request, causing
denial of service.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2494722
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202494722%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
