[From nobody Thu Aug 20 20:53:04 2026
Received: (at submit) by bugs.debian.org; 13 Aug 2026 09:46:18 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-118.9 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,
 DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FROMDEVELOPER,HAS_PACKAGE,
 SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 11; hammy, 139; neutral, 32; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <smcv@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:35134)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1wuS0w-00GqSZ-1X
 for submit@bugs.debian.org; Thu, 13 Aug 2026 09:46:18 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Type:MIME-Version:Message-ID:
 Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=tMNUctXzyToeMpuENsTUeaU4zJIRV99pd6MA5BMtcDQ=; b=IMxSa4VsX3jZrRsD481gDelp7R
 7qWCH2W7P2RB6Moefs+7JfG10u82MR/iHEdcv3xVkuK1dS5ENXmlZneTgOXeXs8ljwZhVywEatO3I
 pGfxMQ+vzQ+NgKPeQTzo9kDzCsGjYKhMUJWZPn0QrEWSy5LD/Ll39X8TS4AMNuuH58X+Qt62CxYLM
 WZ/rFB4Dq7N04xXjsbYEY+p2yuVhXDVEaaAKCKSIoKltRhbsOI+/s9XLNZKpPS+gKs/6EkUTrSZN0
 k1SiaYjgDoFxhtOwM+6zHCJ2g3lz4RCnCwltYo2wrddMQnasmIItbJ7RwYbTSCxSr6vpj1PE9wexq
 n5pKaszg==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1wuS0u-0051Mc-2s
 for submit@bugs.debian.org; Thu, 13 Aug 2026 09:46:17 +0000
Date: Thu, 13 Aug 2026 10:46:14 +0100
From: Simon McVittie <smcv@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libostree-1-1:amd64: regression in flatpak after fixing
 GHSA-7cgc-gp99-6jmm: Decompressed delta part exceeds configured limit
Message-ID: <an2SZqWwCdBz8rdY@definition.pseudorandom.co.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Mutt-Fcc: =.lists.debian/
X-Reportbug-Version: 13.2.0+nmu1
X-Debian-User: smcv
Delivered-To: submit@bugs.debian.org

Package: libostree-1-1
Version: 2026.3-1
Severity: serious
Tags: upstream help
Forwarded: https://github.com/ostreedev/ostree/issues/3635

After updating ostree to 2026.3 (fixing denial-of-service issue 
GHSA-7cgc-gp99-6jmm), some Flatpak users are reporting that updating 
apps from Flathub fails:

>Error: While pulling app/org.mozilla.firefox/x86_64/stable from remote flathub: Decompressed delta part exceeds configured limit of 60543795 bytes

Let's not let this migrate to testing until a fix is available.

I am unlikely to be able to fix this myself without re-introducing the 
DoS issue, so I would appreciate help from anyone who understands 
libostree's download protocol better than I do.

    smcv
]