Skip to content
OpenAdvisories
High RHSA-2026:73539 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 1, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hdf5 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-devel 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich-devel 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-mpich-static 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi-devel 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-openmpi-static 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 hdf5-static 0:2.2.0-0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 java-hdf5 0:2.2.0-0.1.2.hum1

Vulnerabilities 5

  • High 8.5
    CVE-2026-106547

    HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata

    A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init()…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-19027

    HDF5 out-of-bounds heap read in N-Bit filter decompression

    The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size.…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-19026

    Nbit filter NULL/short parameter-array dereference

    H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial o…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-19028

    HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

    H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-19029

    HDF5 scale-offset filter heap buffer over-read via crafted chunk

    A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the data…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-19026
  • report
    https://access.redhat.com/security/cve/CVE-2026-19027
  • report
    https://access.redhat.com/security/cve/CVE-2026-19028
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-106547
  • report
    https://access.redhat.com/security/cve/CVE-2026-19029
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73539.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511851
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19026
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19026
  • article
    https://github.com/HDFGroup/hdf5/issues/6489
  • article
    https://github.com/HDFGroup/hdf5/issues/6492
  • article
    https://github.com/HDFGroup/hdf5/pull/6497
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511860
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19027
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19027
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19028
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19028
  • article
    https://github.com/HDFGroup/hdf5/issues/6488
  • article
    https://github.com/HDFGroup/hdf5/issues/6490
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2547140
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19029
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19029
  • article
    https://github.com/HDFGroup/hdf5/pull/6718
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2547141
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-106547
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-106547
  • article
    https://github.com/HDFGroup/hdf5/pull/6529