Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/HDFGroup/hdf5/issues/6403 Diğer

Kayıt geçmişi

1. 2 Kas 2026 22:39Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted File
• 6,9 CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
• 1,9 CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize
• 7,5 CVE-2026-115290Elasticsearch'te kontrolsüz özyineleme nedeniyle hizmet reddi (DoS) açığı
• 6,5 CVE-2026-121423SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
• 4,3 CVE-2026-101180DoS vulnerability in the file parsing module.