Skip to content
OpenAdvisories
High RHSA-2026:61630 6 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 1, 2026 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hdf5 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-devel 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich-devel 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich-static 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi-devel 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi-static 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-static 0:2.2.0-0.1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 java-hdf5 0:2.2.0-0.1.1.hum1

Vulnerabilities 6

  • High 7.8
    CVE-2026-34734

    HDF5: H5T__conv_struct Use After Free

    HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from …

    HDFGroup hdf5 hdf5 hdf5 Debian Ubuntu
  • Medium 6.8
    CVE-2026-19025

    HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open

    H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time.…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-26197

    Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c

    HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bound…

    HDFGroup hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-17572

    HDF5 SOHM List Index Heap Buffer Overflow

    Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 4.6
    CVE-2026-92627

    Heap Use-After-Free in H5T__conv_f_f

    A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subseque…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu
  • Medium 4.0
    CVE-2026-17573

    Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field

    A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-19025
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-26197
  • report
    https://access.redhat.com/security/cve/CVE-2026-17573
  • report
    https://access.redhat.com/security/cve/CVE-2026-17572
  • report
    https://access.redhat.com/security/cve/CVE-2026-92627
  • report
    https://access.redhat.com/security/cve/CVE-2026-34734
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61630.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507561
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17572
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17572
  • article
    https://github.com/HDFGroup/hdf5/issues/6501
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507553
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17573
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17573
  • article
    https://github.com/HDFGroup/hdf5/issues/6124
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511850
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19025
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19025
  • article
    https://github.com/HDFGroup/hdf5/issues/6491
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502846
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-26197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-26197
  • article
    https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2457034
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34734
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34734
  • article
    https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535513
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-92627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-92627
  • article
    https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption