GHSA-fg6r-xgp8-x64r

Source

https://github.com/advisories/GHSA-fg6r-xgp8-x64r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fg6r-xgp8-x64r/GHSA-fg6r-xgp8-x64r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fg6r-xgp8-x64r

Withdrawn

2026-06-30T18:47:21Z

Published

2026-03-02T06:32:01Z

Modified

2026-06-30T19:00:32Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rxpr-wq63-jr7p. This link is maintained to preserve external references.

Original Description

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-404",
        "CWE-787"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-30T18:47:21Z",
    "nvd_published_at":  "2026-03-02T04:16:06Z",
    "severity":  "LOW"
}

References

Affected packages

PyPI / openbabel

Package

Name: openbabel; View open source insights on deps.dev
Purl: pkg:pypi/openbabel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.0

Affected versions

1.*

1.8

1.8.1

1.8.2

1.8.3

1.8.4

2.*

2.4.0

2.4.1

3.*

3.0.0a1

3.0.0

3.1.1

3.1.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fg6r-xgp8-x64r/GHSA-fg6r-xgp8-x64r.json"