High, CVSS 7.5MavenAmendedPublished
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
CVE-2026-102834 · GHSA-rxjv-24xq-76wc
- Affected
- Maven org.bytedeco:javacv < 1.5.14
- Fixed in
- 1.5.14· Vendor fix available
- Issue
- IPCameraFrameGrabber parses the Content-Length value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over http://, as documented in the class itself) - can supply a Content-Length value in the range 1073741825-2147483647. This drives the internal buffer-growth routine ensureBufferCapacity(int) into 32-bit signed integer overflow, which turns the "grow the buffer" loop into a true infinite loop: the loop variable oscillates to 0 and never again satisfies the loop's exit condition. The thread that called grab()/grabBufferedImage() spins at 100% CPU forever and never returns, permanently hanging the calling application's frame-grabbing thread with no exception, timeout, or interrupt path available to the caller. Details File:…
Recommended action: Upgrade to 1.5.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.