JLSEC-2026-1094

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1094.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1094.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-1094

Upstream

CVE-2026-8257

EUVD-2026-29013

GHSA-gmmj-chcc-2f2x

Published

2026-07-31T20:09:46.097Z

Modified

2026-07-31T20:20:44.709132056Z

Severity

1.7 (Low) CVSS_V2 - AV:L/AC:L/Au:S/C:N/I:N/A:P CVSS Calculator
5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function...

Details

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.

Database specific

{
    "sources": [
        {
            "modified": "2026-06-17T11:03:44.290Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-8257",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8257",
            "published": "2026-05-11T02:16:27.090Z",
            "id": "CVE-2026-8257",
            "database_specific": {
                "status": "Analyzed"
            },
            "imported": "2026-07-22T01:20:24.155Z"
        },
        {
            "id": "GHSA-gmmj-chcc-2f2x",
            "html_url": "https://github.com/advisories/GHSA-gmmj-chcc-2f2x",
            "published": "2026-05-11T03:31:31Z",
            "url": "https://api.github.com/advisories/GHSA-gmmj-chcc-2f2x",
            "modified": "2026-05-11T03:31:38Z",
            "imported": "2026-07-22T01:20:27.661Z"
        },
        {
            "id": "EUVD-2026-29013",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29013",
            "published": "2026-05-11T00:30:13Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-29013",
            "modified": "2026-05-11T17:31:23Z",
            "imported": "2026-07-22T01:20:25.729Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / Binaryen_jll

Package

Name: Binaryen_jll
Purl: pkg:julia/Binaryen_jll?uuid=a54ac8ab-712d-5a0e-8e11-9296c0d3c20e

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.130.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1094.json"