EUVD-2026-33681
GHSA-gqw4-cq8m-g989
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in janet-lang janet up to 1.41.0. This vulnerability affects the function unmarshal_one_fiber of the file src/core/marsh.c. Executing a manipulation can lead to integer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d9b1d711ea1fde52ac73a82088b512a3e17bad0d. A patch should be applied to remediate this issue.
AnalysisAI
Integer overflow in the Janet scripting language's fiber unmarshaling routine (versions up to 1.41.0) allows a local authenticated attacker to cause a denial-of-service condition. The vulnerable function unmarshal_one_fiber in src/core/marsh.c performs an unchecked addition when computing fiber stack capacity - if fiber_stacktop is near INT32_MAX, adding 10 wraps the value, resulting in a dangerously small capacity allocation that crashes the interpreter. No public exploitation in production environments has been confirmed (not listed in CISA KEV), but a public proof-of-concept exploit exists, and the upstream patch has been released as commit d9b1d711.
Technical ContextAI
Janet is a lightweight, embeddable scripting language written in C. The affected code path involves the deserialization (unmarshaling) subsystem in src/core/marsh.c, specifically the unmarshal_one_fiber function responsible for reconstructing fiber (coroutine) state from serialized bytes. The root cause is CWE-190 (Integer Overflow or Wraparound): the expression fiber->capacity = fiber_stacktop + 10 is evaluated without checking whether fiber_stacktop is close to INT32_MAX. If a crafted marshaled payload supplies a fiber_stacktop value in the range (INT32_MAX - 9, INT32_MAX], the addition wraps around to a small or negative integer, yielding an invalid capacity field. This can lead to under-allocation of the fiber stack buffer, producing memory corruption or an immediate crash when the runtime subsequently writes stack frames. The affected CPE is cpe:2.3:a:janet-lang:janet:*:*:*:*:*:*:*:* covering all versions through 1.41.0.
RemediationAI
Apply upstream patch commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d from the Janet GitHub repository (https://github.com/janet-lang/janet/commit/d9b1d711ea1fde52ac73a82088b512a3e17bad0d). The fix wraps the capacity assignment in a bounds check: if fiber_stacktop < INT32_MAX - 10, the original expression is used; otherwise fiber->capacity is clamped to INT32_MAX, avoiding overflow. Consumers using Janet as an embedded library should rebuild from a patched commit or wait for a tagged release incorporating this fix - a specific tagged release version was not independently confirmed from available data, so verify with the upstream project. As a compensating control where patching is not immediately feasible, restrict the ability of untrusted users or processes to supply marshaled Janet data to the interpreter, particularly in sandboxed or shared environments. This control trades off some Janet deserialization functionality but eliminates the attack surface for this class of exploit.
Janet before 1.22.0 mishandles arrays. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no au
A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_v
A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/cor
A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/o
A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today