ANT-2026-07KFWYV3
Thread-safety and out-of-bounds reads in the HTTP.jl content-type sniffer
Description
The content-type sniffer had two memory/concurrency bugs. Number sniffing in isjson stored the strtod end-pointer out-parameter in a shared module-global Vector{Ptr{UInt8}}; concurrent sniff calls on a multithreaded server raced on that single cell between the ccall and the subsequent read, producing a non-deterministic consumed length and parse result an attacker could use to influence content-type classification. The bytes handed to jl_strtod_c were also not NUL-terminated, so strtod could read past the provided buffer. Separately, the MP4 ftyp matcher iterated comparison windows under @inbounds with a loop bound that, when boxsize == length(data), read up to three bytes past the end of the buffer.
Impact
On a multithreaded server, attacker-influenced input could non-deterministically affect content-type classification, and crafted buffers could trigger out-of-bounds heap reads (crash or potential information disclosure).
Patches
Fixed in HTTP.jl v2.4.0. The shared global is removed in favor of a per-call Ref; numeric input is copied into a freshly allocated NUL-terminated buffer so strtod is bounded; and the MP4 matcher's loop upper bound is clamped so every comparison window lies fully within the buffer.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
What each source reports
OSVJLSEC-2026-621 No score
Thread-safety and out-of-bounds reads in the HTTP.jl content-type sniffer
Description
The content-type sniffer had two memory/concurrency bugs. Number sniffing in isjson stored the strtod end-pointer out-parameter in a shared module-global Vector{Ptr{UInt8}}; concurrent sniff calls on a multithreaded server raced on that single cell between the ccall and the subsequent read, producing a non-deterministic consumed length and parse result an attacker could use to influence content-type classification. The bytes handed to jl_strtod_c were also not NUL-terminated, so strtod could read past the provided buffer. Separately, the MP4 ftyp matcher iterated comparison windows under @inbounds with a loop bound that, when boxsize == length(data), read up to three bytes past the end of the buffer.
Impact
On a multithreaded server, attacker-influenced input could non-deterministically affect content-type classification, and crafted buffers could trigger out-of-bounds heap reads (crash or potential information disclosure).
Patches
Fixed in HTTP.jl v2.4.0. The shared global is removed in favor of a per-call Ref; numeric input is copied into a freshly allocated NUL-terminated buffer so strtod is bounded; and the MP4 matcher's loop upper bound is clamped so every comparison window lies fully within the buffer.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
- Record
JLSEC-2026-621- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HTTPJulia |
before 2.4.0 | 2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
ANT-2026-07KFWYV3 is a vulnerability with no CVSS score yet in HTTP, published June 23, 2026. No source lists public exploit code. Fixed in HTTP 2.4.0.