CVE catalog

CVE-2025-0838

Abseil vulnerability

There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1

Severity: Medium · CVSS 5.6CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
Published: Feb 21, 2025, 2:20:52 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.63% · Oct 27, 2026

Projects and upstream resources

[abseil-cpp][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "abseil",
      "status": "fixed",
      "release": "sid",
      "version": "20260526.0-2"
    },
    {
      "name": "abseil",
      "status": "fixed",
      "release": "forky",
      "version": "20260526.0-2"
    },
    {
      "name": "abseil",
      "status": "fixed",
      "release": "trixie",
      "version": "20240722.0-4"
    },
    {
      "name": "abseil",
      "status": "fixed",
      "release": "bookworm",
      "version": "20220623.1-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1098903,
      "name": "abseil",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "20240722.0-3"
    },
    {
      "bug": 1098903,
      "name": "abseil",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "20240722.0-3"
    },
    {
      "bug": 1098903,
      "name": "abseil",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "20240722.0-3"
    },
    {
      "bug": 1098903,
      "name": "abseil",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "20220623.1-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "abseil",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "20220623.1-3.1ubuntu3.2"
    },
    {
      "name": "libabsl-dev",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "20220623.1-3.1ubuntu3.2"
    },
    {
      "name": "libabsl20220623t64",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "20220623.1-3.1ubuntu3.2"
    },
    {
      "name": "abseil",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0~20210324.2-2ubuntu0.2"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0~20200923.3-3ubuntu1",
        "0~20210324.2-2"
      ],
      "ecosystem": "deb",
      "fixed_version": "0~20210324.2-2ubuntu0.2",
      "provider_record_id": "USN-7505-1"
    },
    {
      "name": "abseil",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20220623.1-3.1ubuntu3.2"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "20220623.1-3",
        "20220623.1-3.1ubuntu1",
        "20220623.1-3.1ubuntu3"
      ],
      "ecosystem": "deb",
      "fixed_version": "20220623.1-3.1ubuntu3.2",
      "provider_record_id": "USN-7505-1"
    },
    {
      "name": "abseil",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0~20210324.2-2ubuntu0.2"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0~20200923.3-3ubuntu1",
        "0~20210324.2-2"
      ],
      "ecosystem": "deb",
      "fixed_version": "0~20210324.2-2ubuntu0.2",
      "provider_record_id": "UBUNTU-CVE-2025-0838"
    },
    {
      "name": "abseil",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20220623.1-3.1ubuntu3.2"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "20220623.1-3",
        "20220623.1-3.1ubuntu1",
        "20220623.1-3.1ubuntu3"
      ],
      "ecosystem": "deb",
      "fixed_version": "20220623.1-3.1ubuntu3.2",
      "provider_record_id": "UBUNTU-CVE-2025-0838"
    },
    {
      "name": "abseil",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240722.0-3ubuntu1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "20230802.1-4.2"
      ],
      "ecosystem": "deb",
      "fixed_version": "20240722.0-3ubuntu1",
      "provider_record_id": "UBUNTU-CVE-2025-0838"
    },
    {
      "name": "abseil-cpp",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20250814.0-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20250814.0-2.1",
      "provider_record_id": "OPENSUSE-SU-2025:15473-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20230802.3-slfo.1.1_1.1"
            }
          ]
        }
      ],
      "release": "linux micro 6.1",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20230802.3-slfo.1.1_1.1",
      "provider_record_id": "SUSE-SU-2026:20361-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20230802.3-1.1"
            }
          ]
        }
      ],
      "release": "linux micro 6.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20230802.3-1.1",
      "provider_record_id": "SUSE-SU-2026:20268-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20230802.3-150400.10.7.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.3",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20230802.3-150400.10.7.1",
      "provider_record_id": "SUSE-SU-2026:0576-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240116.3-8.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server ltss extended security 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20240116.3-8.6.1",
      "provider_record_id": "SUSE-SU-2026:0412-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240116.3-150600.19.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20240116.3-150600.19.6.1",
      "provider_record_id": "SUSE-SU-2026:0338-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240116.3-150600.19.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20240116.3-150600.19.6.1",
      "provider_record_id": "SUSE-SU-2026:0338-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240116.3-150500.13.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20240116.3-150500.13.10.1",
      "provider_record_id": "SUSE-SU-2026:0381-1"
    },
    {
      "name": "abseil-cpp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20240116.3-150500.13.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20240116.3-150500.13.10.1",
      "provider_record_id": "SUSE-SU-2026:0381-1"
    }
  ]
}

[Debian bug #1098903]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libabsl20220623]Unknown
Source package: [abseil]
Details (2)
- 20220623.1-1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 20220623.1-1+deb12u1
  usn · abseil · debian · bookworm; usn · abseil · debian · 12
- 20220623.1-1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 20220623.1-1+deb12u1
  usn · abseil · debian · bookworm; usn · abseil · debian · 12
[libabsl-dev]Unknown
Source package: [abseil]
Details (2)
- 20220623.1-1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 20220623.1-1+deb12u1
  usn · abseil · debian · bookworm; usn · abseil · debian · 12
- 20220623.1-1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 20220623.1-1+deb12u1
  usn · abseil · debian · bookworm; usn · abseil · debian · 12

[Debian 13 (Trixie)]

[libabsl20240722]Unknown
Source package: [abseil]
Details (2)
- 20240722.0-4 · amd64 · trixie
  Fixed · Fixed: 20240722.0-3
  usn · abseil · debian · 13
- 20240722.0-4 · arm64 · trixie
  Fixed · Fixed: 20240722.0-3
  usn · abseil · debian · 13
[libabsl-dev]Unknown
Source package: [abseil]
Details (2)
- 20240722.0-4 · amd64 · trixie
  Fixed · Fixed: 20240722.0-3
  usn · abseil · debian · 13
- 20240722.0-4 · arm64 · trixie
  Fixed · Fixed: 20240722.0-3
  usn · abseil · debian · 13

[openSUSE Tumbleweed]

[abseil-cpp-devel]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_base2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_base2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_base_cpu_detect2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_base_cpu_detect2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_city2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_city2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_civil_time2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_civil_time2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_clock_interface2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_clock_interface2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_cord2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_cord2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_cord_internal2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_cord_internal2608_0_0-32bit]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed
[libabsl_cordz_functions2608_0_0]Unknown
Source package: [abseil-cpp]
Details (1)
- 20260817.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 20250814.0-2.1
  Version impact unknown
  usn · abseil-cpp · opensuse · tumbleweed

Next results

Observed: Oct 26, 2026, 11:18:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]