{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19028 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-19028 is a medium-severity vulnerability in The HDF Group HDF5, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-19028 and fix it if it is affected.\n\nWhat it is: CVE-2026-19028 is a medium-severity vulnerability in The HDF Group HDF5, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19028 exists.\n\nAffected product: The HDF Group HDF5. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-19028/ (Markdown: https://insights.sbomify.com/CVE-2026-19028/index.md)","id":"CVE-2026-19028","markdown":"https://insights.sbomify.com/CVE-2026-19028/index.md","name":"CVE-2026-19028","record":{"aliases":["AZL-94499","DEBIAN-CVE-2026-19028","ECHO-a9d3-2518-671d","GHSA-2hg9-348w-39gj","UBUNTU-CVE-2026-19028"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"HDF5 data library","requires_auth":"none","summary":"Attackers can cause denial of service via crafted HDF5 files triggering an integer underflow and out-of-bounds read in the Fletcher32 filter.","user_interaction":"required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"HDFG","cpe":[],"cvss":{"score":6.8,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"},{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input"},{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read","id":"CVE-2026-19028","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"HDF5 scale-offset filter heap buffer over-read via crafted chunk","id":"CVE-2026-19029"},"packages":[],"prev":{"headline":"HDF5 out-of-bounds heap read in N-Bit filter decompression","id":"CVE-2026-19027"},"products":["HDF5"],"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-06","vendors":["The HDF Group"]},"summary":"Attackers can cause denial of service via crafted HDF5 files triggering an integer underflow and out-of-bounds read in the Fletcher32 filter.","url":"https://insights.sbomify.com/CVE-2026-19028/"}