https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:01:25 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102834 <p>JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.</p> <p>JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102834 https://db.gcve.eu/vuln/ghsa-rxjv-24xq-76wc <p><strong>Affected:</strong> Maven: org.bytedeco:javacv</p> <p>### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over `http://`, as documented in the class itself) - can supply a `Content-Length` value in the range `1073741825`-`2147483647`. This drives the internal buffer-growth routine `ensureBufferCapacity(int)` into 32-bit signed integer overflow, which turns the &#34;grow the buffer&#34; loop into a true infinite loop: the loop variable oscillates to `0` and never again satisfies the loop&#39;s exit condition. The thread that called `grab()`/`grabBufferedImage()` spins at 100% CPU forever and never returns, permanently hanging the calling application&#39;s frame-grabbing thread with no exception, timeout, or interrupt path available to the caller.</p> <p>### Details File: `src/main/java/org/bytedeco/javacv/IPCameraFrameGrabber.java`</p> <p>```java private byte[] readImage() throws IOException { ... int c0 = subheader.indexOf(&#34;content-length: &#34;); final int c1 = subheader.indexOf(&#39;\r&#39;, c0); if (c0 &lt; 0) { throw new EOFException(&#34;The camera stream ended unexpectedly&#34;); } c0 += 16; final int contentLength = Integer.parseInt(subheader.substring(c0, c1).trim()); // &lt;-- fully attacker-controlled // adaptive size - careful - don&#39;t want a 2G jpeg…</p> <p><strong>Affected:</strong> Maven: org.bytedeco:javacv</p> <p>### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over `http://`, as documented in the class itself) - can supply a `Content-Length` value in the range `1073741825`-`2147483647`. This drives the internal buffer-growth routine `ensureBufferCapacity(int)` into 32-bit signed integer overflow, which turns the &#34;grow the buffer&#34; loop into a true infinite loop: the loop variable oscillates to `0` and never again satisfies the loop&#39;s exit condition. The thread that called `grab()`/`grabBufferedImage()` spins at 100% CPU forever and never returns, permanently hanging the calling application&#39;s frame-grabbing thread with no exception, timeout, or interrupt path available to the caller.</p> <p>### Details File: `src/main/java/org/bytedeco/javacv/IPCameraFrameGrabber.java`</p> <p>```java private byte[] readImage() throws IOException { ... int c0 = subheader.indexOf(&#34;content-length: &#34;); final int c1 = subheader.indexOf(&#39;\r&#39;, c0); if (c0 &lt; 0) { throw new EOFException(&#34;The camera stream ended unexpectedly&#34;); } c0 += 16; final int contentLength = Integer.parseInt(subheader.substring(c0, c1).trim()); // &lt;-- fully attacker-controlled // adaptive size - careful - don&#39;t want a 2G jpeg…</p> https://db.gcve.eu/vuln/ghsa-rxjv-24xq-76wc