CVE-2021-36691: 
NixOS vulnerability analysis and mitigation

libjxl v0.5.0 contains an assertion failure vulnerability in the PlaneBase::PlaneBase function within lib/jxl/image.cc. The vulnerability was discovered and disclosed in August 2021, affecting the JPEG XL encoder component. This security issue impacts systems using libjxl version 0.5.0 for image processing operations (MITRE CVE, NVD).

The vulnerability occurs during the encoding process of GIF files using the cjxl tool. The issue stems from an assertion failure in the PlaneBase::PlaneBase constructor when processing certain GIF files. The root cause appears to be related to memory allocation size calculations, where extremely large values can trigger the assertion check failure (GitHub Issue).

When successfully exploited, this vulnerability can lead to a denial of service condition. When attempting to encode a malicious GIF file using cjxl, the application crashes due to the assertion failure, making the service temporarily unavailable (MITRE CVE).

The vulnerability affects libjxl version 0.5.0, and users are advised to update to a newer version of the software. As of the latest information available, this issue remains unfixed in several distributions including Debian bookworm, trixie, and sid (Debian Security).