Bug 2441201 - CVE-2026-26200 hdf5: HDF5: Denial of Service due to heap buffer overflow when parsing a crafted h5 file [epel-all]
Summary: CVE-2026-26200 hdf5: HDF5: Denial of Service due to heap buffer overflow when...
Keywords:
Status: NEW
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: hdf5
Version: epel10
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Orion Poplawski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["5310463e-0ba8-449e-b709-9...
Depends On:
Blocks: CVE-2026-26200
TreeView+ depends on / blocked
 
Reported: 2026-02-19 23:35 UTC by Jon Moroney
Modified: 2026-04-24 02:29 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jon Moroney 2026-02-19 23:35:40 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 timothy.a.meader 2026-04-23 14:39:52 UTC
After a lengthy discussion on the Fedora EPEL matrix.org chat, I'd like to request, if possible, a possible "incompatible update" to bring the version of the HDF5 library in EPEL8 and EPEL9 up to either the same level (which is currently 1.14.5) in EPEL10, or even 1.14.6 (the level in Fedora 44 currently).

Comment 2 Orion Poplawski 2026-04-24 01:08:44 UTC
Can you post a link to the discussion?  I'm not seeing it in my chat client.

But I'm almost certainly a hard no on this.  Especially for EPEL8 which no longer in development but just in maintenance mode.  This would be an ABI (ad possibly API) breaking change.  It's unlikely that all dependencies would rebuild with 1.14.

Comment 3 timothy.a.meader 2026-04-24 01:50:20 UTC
I'm happy to provide you with a copy of the chat if you have your handle on the Fedora EPEL matrix forum? It was a one-on-one with the user "carlwgeorge:fedora.im"

Comment 4 Orion Poplawski 2026-04-24 02:25:41 UTC
@orion:fedora.im  - but nevermind, I see your question now.  I wouldn't describe it as a "lengthy discussion".

Comment 5 Orion Poplawski 2026-04-24 02:29:31 UTC
I will say that if you can manage to identify the actual commit that fixed this issue I could spend some time seeing if it could be back-ported.  But I've had very little luck getting this information out of hdf5.


Note You need to log in before you can comment on or make changes to this bug.