JLSEC-2026-800

Reseau 1.0.0 through 1.3.1 perform the blocking system getaddrinfo operation from Julia-adopted resolver threads without marking the foreign call as garbage-collector safe. An attacker who can cause an application to resolve a slow hostname can delay stop-the-world garbage collection for the entire process.

Impact

While a resolver worker is blocked outside a GC-safe region, a collection requested by any thread can stall all Julia execution until the operating-system resolver returns. Repeated slow lookups can cause severe service latency or temporary denial of service. Each individual stall remains bounded by the operating system's DNS timeout.

Exploitation requires either attacker influence over hostnames the application resolves or control of a relevant DNS response path.

Technical details

Reseau uses a native resolver pool whose worker threads enter Julia through @cfunction. The POSIX and Winsock resolver wrappers called getaddrinfo with a plain ccall. Because the adopted thread could not reach a safepoint while the resolver blocked, Julia's collector had to wait for it.

Patches

Upgrade to Reseau 1.3.2 or later. The resolver now uses Reseau's @gcsafe_ccall wrapper for the blocking system call on both POSIX and Windows.

Workarounds

Reject or strictly allowlist attacker-supplied hostnames before resolution and cache validated DNS results where appropriate. Isolating untrusted resolution in a separate process also prevents its resolver timeout from blocking the main Julia process. These measures are application-dependent; upgrading is the complete fix.

Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.