DEBIAN-CVE-2026-17574

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-17574

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17574.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-17574

Upstream

CVE-2026-17574

Published

2026-07-27T16:17:04Z

Modified

2026-09-14T17:02:33Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

References

https://security-tracker.debian.org/tracker/CVE-2026-17574

Affected packages

Debian:12 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.8+repack1-1

1.10.10+repack-1

1.10.10+repack-2

1.10.10+repack-3

1.10.10+repack-3.1

1.10.10+repack-3.2

1.10.10+repack-3.2+ports

1.10.10+repack-3.3

1.10.10+repack-4

1.10.10+repack-5

1.12.0+repack-1~exp1

1.12.0+repack-1~exp2

1.12.2+repack-1~exp1

1.14.3+repack-1~exp1

1.14.3+repack1-1~exp2

1.14.3+repack1-1~exp3

1.14.4.3+repack-1~exp1

1.14.4.3+repack-1~exp2

1.14.4.3+repack-1~exp3

1.14.5+repack-1~exp1

1.14.5+repack-1~exp2

1.14.5+repack-1~exp3

1.14.5+repack-1~exp4

1.14.5+repack-1~exp5

1.14.5+repack-1~exp6

1.14.5+repack-1

1.14.5+repack-2

1.14.5+repack-3~exp1

1.14.5+repack-3~exp2

1.14.5+repack-3~exp3

1.14.5+repack-3~exp4

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

2.2.0+repack-5

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17574.json"

Debian:13 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

2.2.0+repack-5

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17574.json"

Debian:14 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.0+repack-1

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17574.json"