OpenCC
Library for conversion between Traditional and Simplified Chinese
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 21
- Cadence
- ~2 months
- Last 12 months
- 7
Reach
- Stars
- 9.9k
Details
- License
- Apache-2.0
- First release
- Aug 02, 2014
| Version | Released | |
|---|---|---|
1.4.2
patch
| ||
1.4.1
patch
| ||
1.4.0
minor
| ||
1.3.2
patch
| ||
1.3.1
patch
| ||
1.3.0
minor
| ||
1.2.0
minor
| ||
1.1.9
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.8
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.7
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.6
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.5
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.4
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.3
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.2
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.1.post1
pre
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.1
patch
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.0.post1
pre
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
1.1.0
major
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
0.2
minor
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev | ||
0.1
initial
1 CVE
GHSA-7fqq-q52p-2jjg
Mar 29, 2026
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
Low
SummaryOpenCC versions before 1.2.0 contain two DetailsTwo independent code paths in OpenCC failed to enforce the invariant:
Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:
In In PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved. Affected versions:
Patched version:
PoCBuild a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in Issue #997. ImpactThis vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution. OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later. CreditOpenCC thanks @oneafter for reporting the issue. Affected versions
0.1
0.2
1.1.0
1.1.0.post1
1.1.1
1.1.1.post1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
+ 2 more Show less
1.1.8
1.1.9
Fixed in
1.2.0
References Updated Mar 29, 2026 · Source: OSV.dev |