Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
HDF5 versions before 2.3.0 are affected when a specially crafted file is opened with H5Fopen and queried with H5Gget_info. The fix is in HDF5 2.3.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.3.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. A specially crafted HDF5 file is opened with H5Fopen and then queried with H5Gget_info
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 9/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The HDF5 library (versions up to 2.2.0) is affected: opening a specially crafted HDF5 file and querying a group in it can cause the library to recurse without limit while reading its internal B-tree structure. This crashes the application that uses HDF5, resulting in a denial of service.
Read the original description
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
What to do
Check whether your setup matches what the bug needs.
A specially crafted HDF5 file is opened with H5Fopen and then queried with H5Gget_infoUpgrade to a fixed version: 2.3.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- The HDF Group HDF5
fixed in 2.3.0
Evidence 1
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120689
What does this mean?
A crafted HDF5 file can make the library's recursive iteration in H5B__iterate_helper() recurse without limit. This exhausts the stack and crashes the application that processes the file.Source: github.com
Am I affected, and how do I check?
The affected range ends before HDF5 2.3.0. The bug triggers when an application opens a specially crafted file with H5Fopen and then calls H5Gget_info on it. To check, run h5dump --version or call H5get_libversion() in the application's HDF5 library.Source: github.com
What should I do about it?
Upgrade HDF5 to version 2.3.0 or later, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data