CVE-2026-88358

Name	CVE-2026-88358
Description	simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149053

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
simdjson (PTS)	bookworm	3.0.1-1	fixed
	trixie	3.12.3-1	vulnerable
	forky, sid	4.6.11-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
simdjson	source	bookworm	(not affected)
simdjson	source	(unstable)	(unfixed)			1149053

Notes

[trixie] - simdjson <no-dsa> (Minor issue)
[bookworm] - simdjson <not-affected> (Vulnerable parse_unpadded() API introduced in 5.0.0)
https://github.com/simdjson/simdjson/issues/2815
https://github.com/simdjson/simdjson/pull/2817
Fixed by: https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577