Description
blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | blosc | 1.20.1-bp152.4.3.1 | openSUSE-SU-2020:2337-1 |
| SUSE Package Hub 15 SP1 | blosc | 1.20.1-bp152.4.3.1 | openSUSE-SU-2020:2337-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | blosc | 1.20.1-bp152.4.3.1 | openSUSE-SU-2020:2337-1 |
| openSUSE Leap 15.1 | blosc | 1.20.1-bp152.4.3.1 | openSUSE-SU-2020:2337-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | blosc2 | < 0.1.7 | 0.1.7 | GHSA-8c7c-2c8j-3xfp |
Advisories 1
- openSUSE-SU-2020:2337-1 Security update for blosc SUSE / openSUSE Security Updates · Feb 4, 2026