diff --git a/third_party/bzip2/README.cosmo b/third_party/bzip2/README.cosmo
index 1a92c1513..4c3aba4ed 100644
--- a/third_party/bzip2/README.cosmo
+++ b/third_party/bzip2/README.cosmo
@@ -9,3 +9,6 @@ ORIGIN
   Author: Mark Wielaard <mark@klomp.org>
   Date:   Sat Jul 13 17:17:58 2019 +0200
   Prepare for 1.0.8 release.
+
+local vulnerability fix:
+- Fix CVE-2019-12900
\ No newline at end of file
diff --git a/third_party/bzip2/decompress.c b/third_party/bzip2/decompress.c
index 1fef62b8f..1ccd2d58f 100644
--- a/third_party/bzip2/decompress.c
+++ b/third_party/bzip2/decompress.c
@@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s )
       GET_BITS(BZ_X_SELECTOR_1, nGroups, 3);
       if (nGroups < 2 || nGroups > BZ_N_GROUPS) RETURN(BZ_DATA_ERROR);
       GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15);
-      if (nSelectors < 1) RETURN(BZ_DATA_ERROR);
+      if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR);
       for (i = 0; i < nSelectors; i++) {
          j = 0;
          while (True) {