Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Security update for jpeg-xl
published 5 months ago
Summary
A security issue affects jpeg-xl (Echo). The advisory does not describe the issue in detail. Update to 0.11.2-0.1~deb13u2+e1 or later. See the linked advisory for details.
What to do
- Update echo jpeg-xl to version 0.11.2-0.1~deb13u2+e1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | jpeg-xl |
< 0.11.2-0.1~deb13u2+e1 Fix: upgrade to 0.11.2-0.1~deb13u2+e1
|
Original advisory text
Assertion failure (abort/DoS) in jxl::PlaneBase::PlaneBase() reachable only when
the cjxl encoder is used to encode a maliciously crafted GIF. There is no memory
corruption and no upstream fix: the upstream tracking issues (#422, #762) remain
open with no merged commit, and Debian rates the issue "unimportant" with a
"Negligible security impact" note and no fixed version in any suite (bookworm
through sid). With no upstream remediation available and negligible impact on the
libjxl decode path we ship, this is not actionable as a backport.
References
Timeline
Published24 May 2026
Updated20 Jul 2026
First seen24 May 2026
Sources
ECHO-07bd-5728-1ad8 · OSV
Track software like this
Free during beta