Re: Security Report: Unbounded Composite Glyph Recursion DoS (CWE-674)

Alan Coopersmith <[email protected]> Wed, 25 Mar 2026 10:38:08 -0700

Newsgroups	gmane.comp.fonts.freetype.devel
Message-ID	<[email protected]>

On 3/24/26 22:18, d0sf3t wrote:
> I'm requesting a 90-day coordinated disclosure window from the date of your 
> acknowledgment.

You've mailed a public mailing list, with public archives visible at
https://lists.nongnu.org/archive/html/freetype-devel/2026-03/index.html
so you've already made an uncoordinated public disclosure.

To report issues privately, you instead need to file an issue in the
tracker at
       https://gitlab.freedesktop.org/freetype/freetype/-/issues
and set the confidentiality flag.

-- 
         -Alan Coopersmith-                 [email protected]
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris