VYPR
Get started
← All advisories
Medium severityNVD Advisory· Published Jan 27, 2026· Updated Apr 15, 2026

CVE-2026-24819

CVE-2026-24819

Description

Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j (weixin4j-base/src/main/java/com/foxinmy/weixin4j/util modules). This vulnerability is associated with program files CharArrayBuffer.Java, ClassUtil.Java.

This issue affects weixin4j.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.foxinmy:weixin4j-baseMaven
<= 1.10.2—

Affected products

1

Patches

1
d1c825835802

Fix Integer Overflow Vulnerability in Buffer Capacity Calculation

https://github.com/foxinmy/weixin4jteresaMay 20, 2025via ghsa
commit
1 file changed · +9 −1
  • weixin4j-base/src/main/java/com/foxinmy/weixin4j/util/CharArrayBuffer.java+9 −1 modified
    @@ -306,7 +306,15 @@ public void ensureCapacity(final int required) {
         }
         final int available = this.buffer.length - this.len;
         if (required > available) {
-            expand(this.len + required);
+          // Use long arithmetic to prevent integer overflow
+          final long newCapacity = (long)this.len + required;
+          
+          // Check against maximum capacity
+          if (newCapacity > MAXIMUM_CAPACITY) {
+            throw new IllegalStateException("Required capacity exceeds maximum: " + 
+                newCapacity + " > " + MAXIMUM_CAPACITY);
+        }  
+          expand(this.len + required);
         }
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.