Vulnerability-Lookup

RHSA-2026:73539

Vulnerability from csaf_redhat - Published: 2026-09-29 22:31 - Updated: 2026-09-30 10:29

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: hdf5: * hdf5-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-mpich-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-mpich-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-mpich-static-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-openmpi-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-openmpi-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-openmpi-static-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-static-2.2.0-0.1.2.hum1 (aarch64, x86_64) * java-hdf5-2.2.0-0.1.2.hum1 (aarch64, x86_64) * hdf5-2.2.0-0.1.2.hum1.src (src) Security Fix(es): hdf5: * CVE-2026-19026 * CVE-2026-19027 * CVE-2026-19028

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-19026

A flaw was found in HDF5. A remote attacker could craft a malicious HDF5 file that, when opened and read, would cause an application using the HDF5 library to crash. This issue stems from improper validation of input data within the N-Bit filter, leading to a denial of service (DoS) and impacting the availability of services that process these files.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-19027

A flaw was found in HDF5, a widely used data management library. This vulnerability allows an attacker to craft a malicious HDF5 file that, when processed, can cause the application to read beyond its allocated memory. This out-of-bounds read could lead to the disclosure of sensitive information or result in a denial of service (DoS), making the application unavailable.

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 21 products, the same list as for CVE-2026-19026

Threats

Impact Moderate

CVE-2026-19028

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file with a specially designed Fletcher32-filtered chunk. When this file is processed, an integer underflow occurs due to insufficient size validation, leading to a massive out-of-bounds read. This vulnerability can cause the application to crash, resulting in a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 21 products, the same list as for CVE-2026-19026

Threats

Impact Moderate

References

24 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:73539	self
https://access.redhat.com/security/cve/CVE-2026-19026	external
https://access.redhat.com/security/cve/CVE-2026-19027	external
https://access.redhat.com/security/cve/CVE-2026-19028	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-19026	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511851	external
https://www.cve.org/CVERecord?id=CVE-2026-19026	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19026	external
https://github.com/HDFGroup/hdf5/issues/6489	external
https://github.com/HDFGroup/hdf5/issues/6492	external
https://github.com/HDFGroup/hdf5/pull/6497	external
https://access.redhat.com/security/cve/CVE-2026-19027	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511860	external
https://www.cve.org/CVERecord?id=CVE-2026-19027	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19027	external
https://access.redhat.com/security/cve/CVE-2026-19028	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511855	external
https://www.cve.org/CVERecord?id=CVE-2026-19028	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19028	external
https://github.com/HDFGroup/hdf5/issues/6488	external
https://github.com/HDFGroup/hdf5/issues/6490	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nhdf5:\n  * hdf5-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-mpich-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-mpich-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-mpich-static-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-openmpi-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-openmpi-devel-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-openmpi-static-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-static-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * java-hdf5-2.2.0-0.1.2.hum1 (aarch64, x86_64)\n  * hdf5-2.2.0-0.1.2.hum1.src (src)\n\nSecurity Fix(es):\n\nhdf5:\n  * CVE-2026-19026\n  * CVE-2026-19027\n  * CVE-2026-19028",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:73539",
        "url": "https://access.redhat.com/errata/RHSA-2026:73539"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19026",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19026"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19027",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19027"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19028",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19028"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73539.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-30T10:29:51+00:00",
      "generator": {
        "date": "2026-09-30T10:29:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:73539",
      "initial_release_date": "2026-09-29T22:31:09+00:00",
      "revision_history": [
        {
          "date": "2026-09-29T22:31:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-29T22:33:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-30T10:29:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-devel@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich-devel@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich-static@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi-devel@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi-static@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-static@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                "product": {
                  "name": "java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_id": "java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-hdf5@2.2.0-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hdf5-0:2.2.0-0.1.2.hum1@src",
                "product": {
                  "name": "hdf5-0:2.2.0-0.1.2.hum1@src",
                  "product_id": "hdf5-0:2.2.0-0.1.2.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5@2.2.0-0.1.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-devel@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich-devel@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-mpich-static@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi-devel@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-openmpi-static@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hdf5-static@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "java-hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                "product": {
                  "name": "java-hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_id": "java-hdf5-0:2.2.0-0.1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/java-hdf5@2.2.0-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-0:2.2.0-0.1.2.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src"
        },
        "product_reference": "hdf5-0:2.2.0-0.1.2.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-static-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hdf5-static-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-hdf5-0:2.2.0-0.1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64"
        },
        "product_reference": "java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "java-hdf5-0:2.2.0-0.1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
        },
        "product_reference": "java-hdf5-0:2.2.0-0.1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-19026",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-05T23:00:54.623590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511851"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HDF5. A remote attacker could craft a malicious HDF5 file that, when opened and read, would cause an application using the HDF5 library to crash. This issue stems from improper validation of input data within the N-Bit filter, leading to a denial of service (DoS) and impacting the availability of services that process these files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hdf5: HDF5: Denial of service via crafted HDF5 file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in HDF5\u0027s N-Bit filter implementation within H5Z__filter_nbit(). When processing dataset pipelines, the function accesses elements in the cd_values array without verifying that the pointer is non-NULL or that cd_nelmts meets the minimum 5-element header requirement. A local attacker can supply a crafted HDF5 file containing an N-Bit filter pipeline with zero client-data values. Opening and reading this file using H5Dread() or utilities like h5ls and h5repack triggers a NULL pointer dereference or out-of-bounds read, causing an application crash and denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19026"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511851",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511851"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19026",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19026"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19026",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19026"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6489",
          "url": "https://github.com/HDFGroup/hdf5/issues/6489"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6492",
          "url": "https://github.com/HDFGroup/hdf5/issues/6492"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/pull/6497",
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        }
      ],
      "release_date": "2026-08-05T22:47:58.227000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T22:31:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73539"
        },
        {
          "category": "workaround",
          "details": "Do not open or process untrusted HDF5 files using applications or CLI tools (such as h5ls or h5repack) linked against vulnerable versions of the HDF5 library. Verify file sources or isolate untrusted file parsing within a restricted, sandboxed environment.",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hdf5: HDF5: Denial of service via crafted HDF5 file"
    },
    {
      "cve": "CVE-2026-19027",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-05T23:21:13.339531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511860"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HDF5, a widely used data management library. This vulnerability allows an attacker to craft a malicious HDF5 file that, when processed, can cause the application to read beyond its allocated memory. This out-of-bounds read could lead to the disclosure of sensitive information or result in a denial of service (DoS), making the application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hdf5: HDF5: Information disclosure and denial of service via crafted HDF5 file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A boundary validation flaw exists in the N-Bit decompression routines (H5Z__nbit_decompress_one_*) within the HDF5 library. When processing datasets via H5Dread(), the functions fail to bound the read index against the compressed buffer size. An attacker can exploit this by enticing a user or automated service to open a crafted HDF5 file with mismatched N-Bit filter parameters, causing a heap out-of-bounds read. This flaw primarily impacts system availability via application crashes, with a secondary risk of minor heap memory disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19027"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511860",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511860"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19027",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19027"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19027",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19027"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6489",
          "url": "https://github.com/HDFGroup/hdf5/issues/6489"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6492",
          "url": "https://github.com/HDFGroup/hdf5/issues/6492"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/pull/6497",
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        }
      ],
      "release_date": "2026-08-05T23:12:20.658000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T22:31:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73539"
        },
        {
          "category": "workaround",
          "details": "Do not open or process untrusted HDF5 files from unverified sources using tools or services linked against the HDF5 library. Enforce strict file-ingestion boundaries or access controls to prevent automated parsing of untrusted datasets.",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hdf5: HDF5: Information disclosure and denial of service via crafted HDF5 file"
    },
    {
      "cve": "CVE-2026-19028",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-05T23:20:57.733425+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511855"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HDF5. An attacker can craft a malicious HDF5 file with a specially designed Fletcher32-filtered chunk. When this file is processed, an integer underflow occurs due to insufficient size validation, leading to a massive out-of-bounds read. This vulnerability can cause the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hdf5: HDF5: Denial of Service via integer underflow in Fletcher32 filter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An integer underflow vulnerability exists in HDF5\u0027s H5Z__filter_fletcher32() function within H5Zfletcher32.c. When reading dataset chunks via H5Dread(), the Fletcher32 filter subtracts a 4-byte checksum length from the buffer size without validating that the buffer is at least 4 bytes. An attacker can exploit this by enticing a user or service to process a crafted HDF5 file containing a sub-4-byte Fletcher32-filtered chunk, causing a size_t wraparound and massive out-of-bounds read in H5_checksum_fletcher32(). The primary impact of this flaw is an application crash leading to a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
          "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
          "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19028"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511855",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511855"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19028",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19028"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19028",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19028"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6488",
          "url": "https://github.com/HDFGroup/hdf5/issues/6488"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/issues/6490",
          "url": "https://github.com/HDFGroup/hdf5/issues/6490"
        },
        {
          "category": "external",
          "summary": "https://github.com/HDFGroup/hdf5/pull/6497",
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        }
      ],
      "release_date": "2026-08-05T23:15:09.580000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T22:31:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73539"
        },
        {
          "category": "workaround",
          "details": "Do not open or process untrusted HDF5 files from unverified sources using tools or services linked against the HDF5 library. Enforce file-ingestion boundaries or access controls to restrict automated parsing of untrusted datasets.",
          "product_ids": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@src",
            "Red Hat Hardened Images:hdf5-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-mpich-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-devel-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-openmpi-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:hdf5-static-0:2.2.0-0.1.2.hum1@x86_64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@aarch64",
            "Red Hat Hardened Images:java-hdf5-0:2.2.0-0.1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hdf5: HDF5: Denial of Service via integer underflow in Fletcher32 filter"
    }
  ]
}

CVE-2026-19026 (GCVE-0-2026-19026)

Vulnerability from cvelistv5 – Published: 2026-08-05 22:47 – Updated: 2026-08-06 14:31

Title

Nbit filter NULL/short parameter-array dereference

Summary

H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 14:31 UTC

CWE

CWE-476 - NULL pointer dereference
CWE-1284 - Improper validation of specified quantity in input

Assigner

HDFG redhat root Scorecard

References

3 references

URL	Tags
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6489
https://github.com/HDFGroup/hdf5/issues/6492

Impacted products

1 product

Vendor	Product	Version
The HDF Group	HDF5	Affected: <=2.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19026",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:31:41.789584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:31:59.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/HDFGroup/hdf5/issues/6489"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HDF5",
          "vendor": "The HDF Group",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=2.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter\u0027s header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter\u0027s header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-165",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-165 File Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper validation of specified quantity in input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T22:47:58.227Z",
        "orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "shortName": "HDFG"
      },
      "references": [
        {
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6489"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6492"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nbit filter NULL/short parameter-array dereference",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
    "assignerShortName": "HDFG",
    "cveId": "CVE-2026-19026",
    "datePublished": "2026-08-05T22:47:58.227Z",
    "dateReserved": "2026-08-05T22:14:40.349Z",
    "dateUpdated": "2026-08-06T14:31:59.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19027 (GCVE-0-2026-19027)

Vulnerability from cvelistv5 – Published: 2026-08-05 23:12 – Updated: 2026-08-06 14:30

Title

HDF5 out-of-bounds heap read in N-Bit filter decompression

Summary

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 14:29 UTC

CWE

CWE-125 - Out-of-bounds read

Assigner

HDFG redhat root Scorecard

References

3 references

URL	Tags
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6489
https://github.com/HDFGroup/hdf5/issues/6492

Impacted products

1 product

Vendor	Product	Version
The HDF Group	HDF5	Affected: <=2.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19027",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:29:51.698432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:30:48.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/HDFGroup/hdf5/issues/6489"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HDF5",
          "vendor": "The HDF Group",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=2.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer\u0027s actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer\u0027s actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T23:12:20.658Z",
        "orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "shortName": "HDFG"
      },
      "references": [
        {
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6489"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6492"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HDF5 out-of-bounds heap read in N-Bit filter decompression",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
    "assignerShortName": "HDFG",
    "cveId": "CVE-2026-19027",
    "datePublished": "2026-08-05T23:12:20.658Z",
    "dateReserved": "2026-08-05T22:14:41.114Z",
    "dateUpdated": "2026-08-06T14:30:48.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19028 (GCVE-0-2026-19028)

Vulnerability from cvelistv5 – Published: 2026-08-05 23:15 – Updated: 2026-08-06 14:25

Title

HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

Summary

H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 14:24 UTC

CWE

CWE-190 - Integer overflow or wraparound
CWE-125 - Out-of-bounds read
CWE-1284 - Improper validation of specified quantity in input

Assigner

HDFG redhat root Scorecard

References

3 references

URL	Tags
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6488
https://github.com/HDFGroup/hdf5/issues/6490

Impacted products

1 product

Vendor	Product	Version
The HDF Group	HDF5	Affected: <=2.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19028",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:24:48.048981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:25:52.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/HDFGroup/hdf5/issues/6488"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HDF5",
          "vendor": "The HDF Group",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=2.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper validation of specified quantity in input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T23:15:09.580Z",
        "orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "shortName": "HDFG"
      },
      "references": [
        {
          "url": "https://github.com/HDFGroup/hdf5/pull/6497"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6488"
        },
        {
          "url": "https://github.com/HDFGroup/hdf5/issues/6490"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
    "assignerShortName": "HDFG",
    "cveId": "CVE-2026-19028",
    "datePublished": "2026-08-05T23:15:09.580Z",
    "dateReserved": "2026-08-05T22:14:41.781Z",
    "dateUpdated": "2026-08-06T14:25:52.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:73539

CVE-2026-19026 (GCVE-0-2026-19026)

CVE-2026-19027 (GCVE-0-2026-19027)

CVE-2026-19028 (GCVE-0-2026-19028)

Tags

Sightings

Nomenclature

Related by attack behaviour