Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jni-rs/jni-rs

              master @ 13fb910
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

src/wrapper/jnienv.rs: most-fixed (4 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Safety: Raw JNI environment lookups and field setters allowed safe code to invoke undefined behavior. Unchecked APIs like `set_static_field_unchecked` were incorrectly marked as safe, and JNIEnv lifetimes could outlive their respective stack frames or thread-attachment guards. This risks severe memory corruption when interfacing with the JVM.

Denial of Service: Failure to manage the lifecycle of local JNI references within utility wrappers like `JNIEnv::get_string` led to local reference leaks. Over time, these leaks exhaust the JVM's reference tables, causing unexpected JVM crashes and Denial of Service.

Denial of Service: Threading-state transitions during JNI thread detachment on Windows could cause deadlocks when using standard Thread Local Storage (TLS) destructors because locks were held across transitions.