AIKIDO-2026-10422

TL;DR

Affected versions of this package contain an integer overflow issue in block-size rounding logic, where very large values above 2^31 can wrap during padding calculations and cause the parser to use incorrect block sizes. This can break parsing behavior, corrupt pipeline state, or trigger unexpected failures when processing crafted input. An attacker may be able to exploit this by supplying a malicious file or payload with oversized header metadata, causing the parser to miscalculate boundaries and potentially induce denial of service or unsafe downstream behavior.