{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abytedecojavacv/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bytedeco:javacv:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-102834"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JavaCV (\u003c 1.5.14)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","java"],"_cs_type":"advisory","_cs_vendors":["Bytedeco"],"content_html":"\u003cp\u003eThe JavaCV library contains a critical vulnerability in the \u003ccode\u003eIPCameraFrameGrabber\u003c/code\u003e class (CVE-2026-102834) that stems from the lack of bounds checking on the \u003ccode\u003eContent-Length\u003c/code\u003e header parsed from multipart MJPEG HTTP streams. Applications using this class for camera stream ingestion are susceptible to a denial-of-service attack. A remote attacker - either a compromised camera device or a network-position attacker capable of tampering with unencrypted HTTP traffic - can send a crafted \u003ccode\u003eContent-Length\u003c/code\u003e header with a value between 1,073,741,825 and 2,147,483,647.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eensureBufferCapacity(int)\u003c/code\u003e processes this value, the internal buffer-growth routine enters an infinite loop due to signed 32-bit integer overflow, where the capacity variable oscillates between negative values and zero. This causes the thread executing the \u003ccode\u003egrab()\u003c/code\u003e method to consume 100% of a CPU core permanently. The thread becomes non-responsive to interrupts, timeouts, or socket closures, effectively hanging the application thread until the entire JVM process is terminated. This affects all JavaCV versions prior to 1.5.14.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker monitors or compromises the network path between a camera and the target application.\u003c/li\u003e\n\u003cli\u003eThe target application initiates a connection to an MJPEG stream using \u003ccode\u003eIPCameraFrameGrabber\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts the HTTP response from the camera stream before it reaches the victim.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a malicious HTTP header \u003ccode\u003eContent-Length\u003c/code\u003e with a value in the range [1073741825, 2147483647].\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eIPCameraFrameGrabber\u003c/code\u003e parses the malicious header into the \u003ccode\u003econtentLength\u003c/code\u003e variable.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eensureBufferCapacity\u003c/code\u003e method is called, triggering the unsigned integer multiplication loop.\u003c/li\u003e\n\u003cli\u003eInteger overflow causes the \u003ccode\u003ecapacity\u003c/code\u003e variable to wrap to \u003ccode\u003eInteger.MIN_VALUE\u003c/code\u003e and eventually \u003ccode\u003e0\u003c/code\u003e, creating an infinite loop.\u003c/li\u003e\n\u003cli\u003eThe CPU utilization of the affected application thread hits 100%, causing a thread-level denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to permanently disable the camera-grabbing functionality of any application using affected versions of JavaCV. In environments where applications spawn individual threads for multiple cameras, an attacker can trigger this vulnerability across multiple connections, leading to resource exhaustion, elevated CPU load, and a complete system-level denial of service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the \u003ccode\u003eorg.bytedeco:javacv\u003c/code\u003e dependency to version 1.5.14 or later across all applications utilizing \u003ccode\u003eIPCameraFrameGrabber\u003c/code\u003e. Teams should also prioritize upgrading camera infrastructure to support HTTPS to mitigate the risk of network-position attackers tampering with the plaintext HTTP response headers.\u003c/p\u003e\n","date_modified":"2026-10-16T22:29:00Z","date_published":"2026-10-16T22:29:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-javacv-dos/","summary":"An integer overflow vulnerability (CVE-2026-102834) in JavaCV's IPCameraFrameGrabber allows a network attacker to cause a permanent CPU-spinning denial-of-service by sending a crafted HTTP Content-Length header.","title":"Integer Overflow in JavaCV IPCameraFrameGrabber Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-10-javacv-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:bytedeco:javacv:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}