CVE vulnerabilities, HIGH severity

[DominiqueChabaud]

Hello,
Some HIGH severity vulnerabilities have been introduced with version 1.14.6. I took a look to the Release schedule but I cannot see when version 2 will be Release or if a version 1.14.7 will be release soon to fix these vulnerabilities.
Thanks for your response.

[mattjala]

Version 2.0.0 is planned for a release within the next few weeks, and it will include a substantial number of CVE fixes. Here's a list of CVE and CVE-adjacent issues fixed since 1.14.6. If the issue you're referring to isn't on this list, and isn't an outstanding CVE, please report the vulnerability under the Security tab.

- https://github.com/HDFGroup/hdf5/pull/4976 / https://github.com/HDFGroup/hdf5/commit/bb5661101a85984ce72835c167874f96279720f7
  - For https://www.cve.org/CVERecord?id=CVE-2022-26061
        https://www.cve.org/CVERecord?id=CVE-2022-25972
        https://www.cve.org/CVERecord?id=CVE-2022-25942
        https://www.cve.org/CVERecord?id=CVE-2020-10809

- https://github.com/HDFGroup/hdf5/pull/5002 / https://github.com/HDFGroup/hdf5/commit/5bdd379a645c1a372ab0bd2e208a1cf960f25acc
  - For https://github.com/HDFGroup/hdf5/issues/4432
        No apparent CVE

- https://github.com/HDFGroup/hdf5/pull/5201 / https://github.com/HDFGroup/hdf5/commit/c0192e236122f483c71723d66dddee2cdc80ed5a
  - For http://osv.dev/vulnerability/OSV-2024-390

- https://github.com/HDFGroup/hdf5/pull/5210 / https://github.com/HDFGroup/hdf5/commit/7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d
  - For http://osv.dev/vulnerability/OSV-2023-77

- https://github.com/HDFGroup/hdf5/pull/5213 / https://github.com/HDFGroup/hdf5/commit/331c000e6a302614d153b443928f18819f0c4f41
  - For https://github.com/HDFGroup/hdf5/issues/4436 / https://github.com/HDFGroup/hdf5/issues/4661
        No apparent CVE

- https://github.com/HDFGroup/hdf5/pull/5076 / https://github.com/HDFGroup/hdf5/commit/99aac48336546d7af6d2ff873f4c728f1066cd67
  - For https://github.com/HDFGroup/hdf5/issues/4431 (possibly also https://github.com/HDFGroup/hdf5/issues/4435?)
        Also seems to relate to https://www.cve.org/CVERecord?id=CVE-2025-6817 which goes to
        https://github.com/HDFGroup/hdf5/issues/5572

- https://github.com/HDFGroup/hdf5/pull/5710 / https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a09c892bc97ac32d9515c3777ce07
  - For https://github.com/HDFGroup/hdf5/issues/5376
        https://github.com/HDFGroup/hdf5/issues/5576
	http://osv.dev/vulnerability/OSV-2023-76 (likely https://www.cve.org/CVERecord?id=CVE-2025-2153)
        https://www.cve.org/CVERecord?id=CVE-2025-2913
	https://www.cve.org/CVERecord?id=CVE-2025-6858

- https://github.com/HDFGroup/hdf5/pull/5722 / https://github.com/HDFGroup/hdf5/commit/804f3bace997e416917b235dbd3beac3652a8a05
  - For https://github.com/HDFGroup/hdf5/issues/5379
        https://github.com/HDFGroup/hdf5/issues/5550
        http://osv.dev/vulnerability/OSV-2024-379
        http://osv.dev/vulnerability/OSV-2024-575
        http://osv.dev/vulnerability/OSV-2024-772
	https://www.cve.org/CVERecord?id=CVE-2025-2914
	https://www.cve.org/CVERecord?id=CVE-2025-7069

- https://github.com/HDFGroup/hdf5/pull/5799 / https://github.com/HDFGroup/hdf5/commit/a8ceb1d95bb997f548c1129363dad53c18540096
  - For https://github.com/HDFGroup/hdf5/issues/5575
        https://www.cve.org/CVERecord?id=CVE-2025-6857

- https://github.com/HDFGroup/hdf5/pull/5814 / https://github.com/HDFGroup/hdf5/commit/0a57195ca67d278f1cf7d01566c121048e337a59
  - For https://github.com/HDFGroup/hdf5/issues/5382
        https://www.cve.org/CVERecord?id=CVE-2025-2924

Currently unmerged PRs:

- https://github.com/HDFGroup/hdf5/pull/5739
  - For https://github.com/HDFGroup/hdf5/issues/5383
        https://www.cve.org/CVERecord?id=CVE-2025-2925

- https://github.com/HDFGroup/hdf5/pull/5746
  - For https://github.com/HDFGroup/hdf5/issues/5380
        https://www.cve.org/CVERecord?id=CVE-2025-2915

- https://github.com/HDFGroup/hdf5/pull/5795
  - For https://github.com/HDFGroup/hdf5/issues/5329
        https://www.cve.org/CVERecord?id=CVE-2025-2153

- https://github.com/HDFGroup/hdf5/pull/5817
  - For https://github.com/HDFGroup/hdf5/issues/4586
        https://github.com/HDFGroup/hdf5/issues/5578
	https://www.cve.org/CVERecord?id=CVE-2025-7068

- https://github.com/HDFGroup/hdf5/pull/5829
  - For https://github.com/HDFGroup/hdf5/issues/5571
        https://github.com/HDFGroup/hdf5/issues/5574
        https://www.cve.org/CVERecord?id=CVE-2025-6816
	https://www.cve.org/CVERecord?id=CVE-2025-6856

- https://github.com/HDFGroup/hdf5/pull/5841
  - For https://github.com/HDFGroup/hdf5/issues/5384
        https://www.cve.org/CVERecord?id=CVE-2025-2926

- https://github.com/HDFGroup/hdf5/pull/5850
  - For https://github.com/HDFGroup/hdf5/issues/5579
        https://github.com/HDFGroup/hdf5/issues/5581
        https://www.cve.org/CVERecord?id=CVE-2025-6269
	https://www.cve.org/CVERecord?id=CVE-2025-6516

- https://github.com/HDFGroup/hdf5/pull/5856
  - For https://github.com/HDFGroup/hdf5/issues/5549
        https://www.cve.org/CVERecord?id=CVE-2025-6750

Miscellaneous issues:

- https://github.com/HDFGroup/hdf5/issues/5193

- https://github.com/HDFGroup/hdf5/issues/5580
  - For https://www.cve.org/CVERecord?id=CVE-2025-6270
    Apparently fixed in develop

- https://github.com/HDFGroup/hdf5/issues/5370
  - For https://www.cve.org/CVERecord?id=CVE-2025-2912
    Apparently fixed in develop

[DominiqueChabaud]

Thanks a lot for your detailed response.
In my list of CVE with HIGH severity (CVSS 3.x metric) I have 8.
4 are in your list:
CVE-2025-2153
CVE-2025-6516
CVE-2025-6856
CVE-2025-6857
4 are not in your list:
CVE-2025-2308
CVE-2025-2309
CVE-2025-2310
CVE-2025-6818

[mattjala]

CVE-2025-6818 corresponds to this issue and a fix is planned for the 2.0.0 release.

I've created corresponding Github issues for the other CVEs you mentioned that weren't in the list. While fixes for these may not make it into the 2.0.0 release itself, they're a high priority for minor releases afterwards.

[Kanishk-Bansal]

Hey @mattjala
Is version 1.14.7 scheduled to address these vulnerabilities? I noticed 1.14.7 is not included in the milestones.

[jhendersonHDF]

Hi @Kanishk-Bansal,

we currently do not have plans for an HDF5 1.14.7 release. However, we are currently finishing up the HDF5 2.0.0 release, which will includes fixes for all these vulnerabilities and a few more not currently listed here.

[opoplawski]

Just a note that without a 1.14.7 release it will be very challenging for distributions to address these CVEs as generally ABI breaking updates cannot be made in stable releases.