CVE-2026-10268

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10268
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10268.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10268
Published
2026-06-01T15:00:12.912Z
Modified
2026-07-15T23:33:37.119657Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
janet-lang janet marsh.c unmarshal_one_fiber integer overflow
Details

A weakness has been identified in janet-lang janet up to 1.41.0. This vulnerability affects the function unmarshalonefiber of the file src/core/marsh.c. Executing a manipulation can lead to integer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d9b1d711ea1fde52ac73a82088b512a3e17bad0d. A patch should be applied to remediate this issue.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-189",
        "CWE-190"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.14"
                },
                {
                    "last_affected": "1.14"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10268.json"
}
References

Affected packages

Git / github.com/janet-lang/janet

Affected ranges

Type
GIT
Repo
https://github.com/janet-lang/janet
Events
Introduced
d66f8333c1d0324f43ec59ad4b66a88d52ec8f4b
Fixed
d9b1d711ea1fde52ac73a82088b512a3e17bad0d
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.10"
        },
        {
            "last_affected": "1.10"
        },
        {
            "introduced": "1.11"
        },
        {
            "last_affected": "1.11"
        },
        {
            "introduced": "1.12"
        },
        {
            "last_affected": "1.12"
        },
        {
            "introduced": "1.13"
        },
        {
            "last_affected": "1.13"
        },
        {
            "introduced": "1.15"
        },
        {
            "last_affected": "1.15"
        },
        {
            "introduced": "1.16"
        },
        {
            "last_affected": "1.16"
        },
        {
            "introduced": "1.17"
        },
        {
            "last_affected": "1.17"
        },
        {
            "introduced": "1.18"
        },
        {
            "last_affected": "1.18"
        },
        {
            "introduced": "1.19"
        },
        {
            "last_affected": "1.19"
        },
        {
            "introduced": "1.20"
        },
        {
            "last_affected": "1.20"
        },
        {
            "introduced": "1.21"
        },
        {
            "last_affected": "1.21"
        },
        {
            "introduced": "1.22"
        },
        {
            "last_affected": "1.22"
        },
        {
            "introduced": "1.23"
        },
        {
            "last_affected": "1.23"
        },
        {
            "introduced": "1.24"
        },
        {
            "last_affected": "1.24"
        },
        {
            "introduced": "1.25"
        },
        {
            "last_affected": "1.25"
        },
        {
            "introduced": "1.26"
        },
        {
            "last_affected": "1.26"
        },
        {
            "introduced": "1.27"
        },
        {
            "last_affected": "1.27"
        },
        {
            "introduced": "1.28"
        },
        {
            "last_affected": "1.28"
        },
        {
            "introduced": "1.29"
        },
        {
            "last_affected": "1.29"
        },
        {
            "introduced": "1.30"
        },
        {
            "last_affected": "1.30"
        },
        {
            "introduced": "1.31"
        },
        {
            "last_affected": "1.31"
        },
        {
            "introduced": "1.32"
        },
        {
            "last_affected": "1.32"
        },
        {
            "introduced": "1.33"
        },
        {
            "last_affected": "1.33"
        },
        {
            "introduced": "1.34"
        },
        {
            "last_affected": "1.34"
        },
        {
            "introduced": "1.35"
        },
        {
            "last_affected": "1.35"
        },
        {
            "introduced": "1.36"
        },
        {
            "last_affected": "1.36"
        },
        {
            "introduced": "1.37"
        },
        {
            "last_affected": "1.37"
        },
        {
            "introduced": "1.38"
        },
        {
            "last_affected": "1.38"
        },
        {
            "introduced": "1.39"
        },
        {
            "last_affected": "1.39"
        },
        {
            "introduced": "1.40"
        },
        {
            "last_affected": "1.40"
        },
        {
            "introduced": "1.41.0"
        },
        {
            "last_affected": "1.41.0"
        }
    ]
}

Affected versions

1.*
1.0
1.1
1.10
1.11
1.12
1.13
1.15
1.16
1.17
1.18
1.19
1.19.1-rc1
1.2
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.3
1.30
1.31
1.32
1.33
1.34
1.35
1.36
1.37
1.38
1.39
1.4
1.40
1.41.0
1.5
1.6
1.7
1.8
1.9
v1.*
v1.0.0
v1.1.0
v1.13.0
v1.13.1
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.18.1
v1.19.0
v1.19.1
v1.19.2
v1.2.0
v1.20.0
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.23.0
v1.24.0
v1.24.1
v1.25.0
v1.25.1
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.29.1
v1.30.0
v1.31.0
v1.32.0
v1.32.1
v1.33.0
v1.34.0
v1.35.0
v1.35.1
v1.35.2
v1.36.0
v1.37.0
v1.37.1
v1.38.0
v1.39.0
v1.39.1
v1.4.0
v1.40.0
v1.40.1
v1.41.0
v1.41.1
v1.41.2
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10268.json"
vanir_signatures 
[
    {
        "id": "CVE-2026-10268-82446426",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/janet-lang/janet/commit/d9b1d711ea1fde52ac73a82088b512a3e17bad0d",
        "deprecated": false,
        "digest": {
            "function_hash": "118727020596014839685098805983286489842",
            "length": 3271.0
        },
        "target": {
            "function": "unmarshal_one_fiber",
            "file": "src/core/marsh.c"
        }
    },
    {
        "id": "CVE-2026-10268-d03da651",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/janet-lang/janet/commit/d9b1d711ea1fde52ac73a82088b512a3e17bad0d",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244347338866202072526395594737916237264",
                "331083265366507787285551742782555731993",
                "322566062036253794471670933391146643464",
                "131560298501921962171823750106052235258"
            ]
        },
        "target": {
            "file": "src/core/marsh.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T23:33:37Z"