{"id":"CVE-2026-120689","kind":"vulnerability","aliases":["CVE-2026-120689"],"related":[],"title":"HDF5: crafted file triggers unbounded recursion and crashes the reader","description":"HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.","summary":"A crafted HDF5 file whose version 1 B-tree points a child back at a node already cached causes the library to recurse without limit in H5B__iterate_helper(). Opening the file and calling H5Gget_info() or H5Gget_num_objs() on a group exhausts the stack and crashes the application, a denial of service.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","data-pipelines","hdf5","package","scientific-computing"],"not_affected_if":["trusted-files-only"],"how_to_check":"- Check the HDF5 library version in use; the sources say versions through `2.2.0` are affected.\n- Look for applications that open HDF5 files from untrusted sources and call `H5Gget_info()` or `H5Gget_num_objs()`.","fix":null,"status":"open","published_at":"2026-11-02T20:17:41+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:41+00:00","updated_at":"2026-11-02T20:36:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T20:36:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HDF5: crafted file triggers unbounded recursion and crashes the reader","impact":"low","summary":"A crafted HDF5 file whose version 1 B-tree points a child back at a node already cached causes the library to recurse without limit in H5B__iterate_helper(). Opening the file and calling H5Gget_info() or H5Gget_num_objs() on a group exhausts the stack and crashes the application, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["hdf5","c","scientific-computing","data-pipelines"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes from stack exhaustion, denial of service only","analyst_note":"Sources give no fixed version or patch; check the HDF5 project release notes for the fix version after 2.2.0.","how_to_check":"- Check the HDF5 library version in use; the sources say versions through `2.2.0` are affected.\n- Look for applications that open HDF5 files from untrusted sources and call `H5Gget_info()` or `H5Gget_num_objs()`.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-files-only"],"who_is_affected":"Applications that link the HDF5 library through version `2.2.0` and open HDF5 files supplied by others, then query group information. Systems that only read files they generate themselves are unlikely to be exposed. unknown whether a patched version exists in the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4331,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120689':13A,16A '-2026':12A,15A '1':32B,99C '2.2.0':83C 'alreadi':43B,152C 'applic':76B,217C 'attack':210C 'b':34B,101C,143C 'b-tree':33B,100C,142C 'back':39B,148C 'bypass':164C 'c':17B 'cach':44B,125C,136C,155C 'call':60B,183C 'caus':45B,168C,224C 'check':119C,166C 'child':38B,110C,145C 'comput':25B 'contain':84C 'count':208C 'craft':2A,27B,138C,195C 'crash':8A,74B,177C 'cve':11A,14A 'data':19B 'data-pipelin':18B 'denial':78B,226C 'deseri':126C 'exhaust':70B,174C 'expect':116C 'file':3A,29B,58B,140C,196C,222C 'first':131C 'function':104C 'get':213C 'group':69B,192C 'h5b':53B,90C,124C,199C 'h5g':202C,206C 'h5gget':61B,64B,184C,187C 'hdf5':1A,21B,28B,81C,139C 'helper':55B,92C 'info':62B,185C,204C 'iter':54B,91C,96C,200C 'lead':171C 'level':113C,117C 'librari':47B 'limit':51B 'load':132C 'malici':221C 'match':114C 'metadata':135C 'node':42B,111C,129C,151C,159C 'num':65B,188C 'obj':66B,189C,203C 'open':56B,219C 'packag':22B 'perform':121C 'pipelin':20B 'point':36B,161C 'pointer':146C 'reach':198C 'reader':10A 'recurs':6A,49B,87C,170C 'refer':147C 'scientif':24B 'scientific-comput':23B 'servic':80B,228C 'src/h5b.c':94C 'stab':207C 'stack':72B,173C 'tree':35B,102C,144C 'trigger':4A,181C 'unbound':5A,169C 'uncontrol':86C 'user':215C 'verifi':107C 'version':31B,98C 'vulner':88C 'whose':30B,141C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Applications that link the HDF5 library through version `2.2.0` and open HDF5 files supplied by others, then query group information. Systems that only read files they generate themselves are unlikely to be exposed. unknown whether a patched version exists in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","datapipelines","hdf5","medium","package","scientificcomputing"],"first_public_at":"2026-11-02T20:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120689","severity":null,"published_at":"2026-11-02T20:17:41+00:00","modified_at":"2026-11-02T20:17:41+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}