Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T15:11:36 hdf5: HDF5: Denial of Service via crafted file requiring user interaction 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-787

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.

A flaw was found in HDF5, a data management library. This vulnerability, a heap-based buffer overflow, allows a local attacker to cause a denial of service (DoS) by persuading a user to open a specially crafted HDF5 file. The malformed file can trigger out-of-bounds memory operations, leading to application crashes or instability.

This Moderate impact vulnerability in HDF5 requires user interaction to process a specially crafted HDF5 file, limiting the attack vector to local scenarios. Successful exploitation can lead to a denial of service. The HDF5 library is used in Red Hat Enterprise Linux AI, Red Hat AI Inference Server, and Red Hat OpenShift AI. Red Hat AI Inference Server Fix deferred rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/model-opt-cuda-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-cuda-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-gaudi-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-neuron-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-rocm-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-spyre-rhel9 Red Hat AI Inference Server Fix deferred rhaii/vllm-tpu-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred hdf5 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-cpu-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-cuda-12.9-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-cuda-13.0-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-neuron-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-rocm-6.4-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-rocm-7.0-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-rocm-7.1-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-spyre-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhai/base-image-tpu-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-autogluon-server-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llm-d-kv-cache-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mlserver-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-17572 https://nvd.nist.gov/vuln/detail/CVE-2026-17572 https://github.com/HDFGroup/hdf5/issues/6501