{"action":"Upgrade jxl-modular to 0.11.3 or later.","affected":[{"fixed":"0.11.3","introduced":"0"}],"component":"jxl-modular","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.11.3"],"ghsa_id":"GHSA-2v8p-fqpx-2q3w","id":"tcs_01M5KERJFCVDMSDCHWR5QMQ65B","modified_at":"2026-07-02T21:00:18.159260333Z","published_at":"2026-07-02T20:44:57Z","references":["https://osv.dev/vulnerability/GHSA-2v8p-fqpx-2q3w","https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-2v8p-fqpx-2q3w","https://github.com/tirr-c/jxl-oxide"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-2v8p-fqpx-2q3w","url":"https://osv.dev/vulnerability/GHSA-2v8p-fqpx-2q3w"}],"summary":"jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)"}