H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by
    subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer
    is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service
    (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file
    with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump
    tools. (CVE-2026-19028)

The version of HDF5 installed on the remote host is 2.2.0 or earlier. It is, therefore, affected by multiple vulnerabilities:

  - H5Z__filter_nbit in H5Znbit.c dereferences cd_values[0] through cd_values[4] without validating that     cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows     attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline     message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
    (CVE-2026-19026)

  - The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and     H5Z__nbit_decompress_one_atomic functions in H5Znbit.c advance a read index into the compressed chunk     buffer without bounding it against the buffer's actual size. This allows attackers to cause an     out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed     dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than     the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
    (CVE-2026-19027)

  - H5Z__filter_fletcher32 in H5Zfletcher32.c computes the data length to checksum by subtracting the 4-byte     trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes,     allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds     read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered     chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. (CVE-2026-19028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by     subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer     is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service     (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file     with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump     tools. (CVE-2026-19028)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458348	Echo: hdf5: security update to 1.14.5+repack-3+e13	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458348	Echo: hdf5: security update to 1.14.5+repack-3+e13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362604	HDF5 <= 2.2.0 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
333050	Linux Distros Unpatched Vulnerability : CVE-2026-19028	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-19028

medium

Tenable Plugins

medium

medium

medium

medium