PYSEC-2026-3701
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/surfio/PYSEC-2026-3701.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3701
- Aliases
-
- CVE-2026-55211
- GHSA-rcr2-hggw-43wm
- Published
- 2026-08-19T11:56:28Z
- Modified
- 2026-08-19T12:45:05Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- surfio has an out-of-bounds read
- Details
-
Impact
Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.
Patches
The bug has been patched in version 0.0.19
- References
-
- https://github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm
- https://github.com/equinor/surfio/pull/86
- https://github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
- https://github.com/equinor/surfio
- https://github.com/equinor/surfio/releases/tag/0.0.19
- https://pypi.org/project/surfio
- https://github.com/advisories/GHSA-rcr2-hggw-43wm
- https://nvd.nist.gov/vuln/detail/CVE-2026-55211
Affected packages
PyPI / surfio
Package
- Name
- surfio
- View open source insights on deps.dev
- Purl
- pkg:pypi/surfio
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.0.19