htslib:hts_open_fuzzer: Heap-buffer-overflow in cram_encode_container

Project: https://github.com/samtools/htslib.git Detailed Report: https://oss-fuzz.com/testcase?key=5098931189776384 Project: htslib Fuzzing Engine: afl Fuzz Target: htsopenfuzzer Job Type: aflasanhtslib Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x78e01cee57d2 Crash...

OESA-2026-3491 htslib security update

HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools. HTSlib only depends on zlib. It is known to be compatible with gcc, g++ and clang. HTSl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: htslib (UTSA-2026-093600)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093600 advisory. HTSlib through 1.10.2 allows out-of-bounds write access in vcfparseformat called from vcfparse and vcfread. Tenable has extracted the preceding description block...

ANT-2026-H4RM2RMD · htslib · Out-of-Bounds Access

oob-read medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-H4RM2RMD: Out-of-bounds access in CRAM xpack/xrle...

OESA-2026-2757 htslib security update

HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools. HTSlib only depends on zlib. It is known to be compatible with gcc, g++ and clang. HTSl...

htslib:hts_open_fuzzer: Null-dereference READ in cram_decoder_init

Project: https://github.com/samtools/htslib.git Detailed Report: https://oss-fuzz.com/testcase?key=4867212363235328 Project: htslib Fuzzing Engine: afl Fuzz Target: htsopenfuzzer Job Type: aflasanhtslib Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State...

htslib:hts_open_fuzzer: Global-buffer-overflow in cram_decoder_init

Project: https://github.com/samtools/htslib.git Detailed Report: https://oss-fuzz.com/testcase?key=6304419888300032 Project: htslib Fuzzing Engine: libFuzzer Fuzz Target: htsopenfuzzer Job Type: libfuzzerasanhtslib Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address:...

WS-2019-0576

Htslib in versions 1.5 to 1.9 is vulnerable to Crash in vcfformat, related to vcf.c...

WS-2019-0569

Htslib in versions 1.4 to 1.9 is vulnerable to Heap-buffer-overflow in bamread1, related to sam.c...

WS-2020-0352

htslib in versions 1.10 to 1.10.2 is vulnerable to Heap-buffer-overflow in htsmd5update , related to cram/cramdecode.c...

WS-2020-0324

HTSlib in versions 1.10 to 1.10.2 is vulnerable to unknown read in hpeek caused by nuances between gzip vs bgzf compressed files...

WS-2021-0070

HTSlib is vulnerable to buffer overflow in htsmd5update. the affected versions are 1.10 to 1.10.2...

htslib:hts_open_fuzzer: Heap-buffer-overflow in cram_encode_container

Project: https://github.com/samtools/htslib.git Detailed Report: https://oss-fuzz.com/testcase?key=5372748074647552 Project: htslib Fuzzing Engine: libFuzzer Fuzz Target: htsopenfuzzer Job Type: libfuzzerasanhtslib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

[SECURITY] Fedora 44 Update: htslib-1.23.1-1.fc44

HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools...

Fedora 42 : bcftools / htslib / samtools (2026-1fc0d39acd)

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fc0d39acd advisory. Update to 1.23.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 44 : bcftools / htslib / samtools (2026-cb321bebb5)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-cb321bebb5 advisory. Update to 1.23.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : bcftools / htslib / samtools (2026-3b06345bf2)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b06345bf2 advisory. Update to 1.23.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 45 : bcftools / htslib / samtools (2026-c383d4a134)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-c383d4a134 advisory. Update to 1.23.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

CVE-2026-31970

A flaw was found in HTSlib, a library used for handling bioinformatics file formats. A remote attacker could exploit an integer overflow vulnerability when a user opens a specially crafted GZI GZIP Index file. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to...

CVE-2026-31966

A flaw was found in htslib, a library for reading and writing bioinformatics file formats. Specifically, within the CRAM Compressed Reference-oriented Alignment Map decoding process, insufficient validation of feature data series could allow a remote attacker to craft malicious CRAM records. This...