Каталог CVE

CVE-2026-31966

HTSlib is a library for reading and writing…

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the `cram_decode_seq()` function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM `MD` tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

Критичність: Medium · CVSS 6.9
Published: Mar 18, 2026, 6:58:47 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.54% · Oct 27, 2026

Projects and upstream resources

[htslib][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	htslib	`1.24-2`	FixedDistribution-reported fixed boundary	[CVE-2026-31966]
Debiansid	htslib	`1.24-3`	Fixed	[CVE-2026-31966]
Debianforky	htslib	`1.24-2`	FixedDistribution-reported fixed boundary	[CVE-2026-31966]
Debianforky	htslib	`1.24-3`	Fixed	[CVE-2026-31966]

Showing 4 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	htslib	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	htslib	Not reported	AffectedDistribution reports no fix	[CVE-2026-31966]
Debianbookworm	htslib	`1.16+ds-3`	Affected	[CVE-2026-31966]
Debianforky	htslib	`1.24-2`	FixedDistribution-reported fixed boundary	[CVE-2026-31966]
Debianforky	htslib	`1.24-3`	Fixed	[CVE-2026-31966]
Debiansid	htslib	`1.24-2`	FixedDistribution-reported fixed boundary	[CVE-2026-31966]
Debiansid	htslib	`1.24-3`	Fixed	[CVE-2026-31966]
Debiantrixie	htslib	Not reported	AffectedDistribution reports no fix	[CVE-2026-31966]
Debiantrixie	htslib	`1.21+ds-1`	Affected	[CVE-2026-31966]

Original provider fields

{
  "package_releases": [
    {
      "name": "htslib",
      "status": "fixed",
      "release": "sid",
      "version": "1.24-3"
    },
    {
      "name": "htslib",
      "status": "fixed",
      "release": "forky",
      "version": "1.24-3"
    },
    {
      "name": "htslib",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.21+ds-1"
    },
    {
      "name": "htslib",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.16+ds-3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1131493,
      "name": "htslib",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.24-2"
    },
    {
      "bug": 1131493,
      "name": "htslib",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.24-2"
    },
    {
      "bug": 1131493,
      "name": "htslib",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1131493,
      "name": "htslib",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "htslib",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "htslib",
      "fixed_version": "",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1131493]

Publisher notes

[trixie] htslib: Minor issue [bookworm] htslib: Minor issue

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

[htslib-test]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.16+ds-3 · all · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
- 1.16+ds-3 · all · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
[libhts3]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.16+ds-3 · amd64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
- 1.16+ds-3 · arm64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
[libhts-dev]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.16+ds-3 · amd64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
- 1.16+ds-3 · arm64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
[tabix]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.16+ds-3 · amd64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12
- 1.16+ds-3 · arm64 · bookworm
  Уражена
  nvd · htslib · debian · bookworm; nvd · htslib · debian · 12

[Debian 13 (Trixie)]

[htslib-test]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.21+ds-1 · all · trixie
  Уражена
  nvd · htslib · debian · 13
- 1.21+ds-1 · all · trixie
  Уражена
  nvd · htslib · debian · 13
[libhts3t64]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.21+ds-1 · amd64 · trixie
  Уражена
  nvd · htslib · debian · 13
- 1.21+ds-1 · arm64 · trixie
  Уражена
  nvd · htslib · debian · 13
[libhts-dev]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.21+ds-1 · amd64 · trixie
  Уражена
  nvd · htslib · debian · 13
- 1.21+ds-1 · arm64 · trixie
  Уражена
  nvd · htslib · debian · 13
[tabix]Невідомо
Пакет джерела: [htslib]
Подробиці (2)
- 1.21+ds-1 · amd64 · trixie
  Уражена
  nvd · htslib · debian · 13
- 1.21+ds-1 · arm64 · trixie
  Уражена
  nvd · htslib · debian · 13

Спостережено: Oct 23, 2026, 10:40:20 PM UTC

Посилання

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]