ECHO-e3c1-3a3b-83ba
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-e3c1-3a3b-83ba.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-e3c1-3a3b-83ba
- Upstream
- Withdrawn
- 2026-09-08T10:27:57Z
- Published
- 2026-09-05T13:04:05Z
- Modified
- 2026-09-08T10:45:14Z
- Summary
- Integer overflow in xmlURIEscapeStr (uri.c). Upstream fix (8edbbdb0) adds `if (len == 0) return(NULL);` after xmlStrlen to catch overflow where xmlStrlen returns 0 for a non-empty input. Debian trixie's 2.9.14-based package already has the equivalent guard `if (!(len > 0)) return(NULL);` at the same site, so the bot's CVE-2026-86139 backport (#21567) is a no-op cosmetic rewrite and is not carried. Verified against the deb13u3 source tree.
- Details
- References