vortex-java is pre-1.0: only the latest release gets security fixes. Fixes ship in a new release, not as backports.

The reader memory-maps and parses untrusted binary input, and every malformed file must throw VortexException (see the security contract in AGENTS.md). These are security bugs:

• a malformed or hostile file that makes the reader throw anything else (ArrayIndexOutOfBoundsException, NegativeArraySizeException, OutOfMemoryError, StackOverflowError, …), hang, or read outside its mapped segment
• a file that makes the reader allocate far more memory than its size justifies

A file that is merely rejected with a VortexException is not. A flaw in the Vortex format or in the Rust reference itself belongs upstream at vortex-data/vortex.

Do not open a public issue. Report it privately through GitHub: Security → Report a vulnerability.

Please include:

• the vortex-java version, JDK version, and OS/arch
• what an attacker can do, and the minimal file or code that triggers it
• the exception or crash you observed

This is a single-maintainer project, so responses are best effort: expect an acknowledgment within a week. Once a fix is released, the advisory is published with credit to the reporter unless you ask otherwise.