Global Buffer Overflow Vulnerability in htslib Package
Summary
OSV-2026-863: Global-buffer-overflow in cram_decoder_init. Affects htslib versions >= d926270f580aa64fab4634859d4518d2d7a5dd7e, < 1b3225f11b7bb55781ad7927f3ef343bc810a21d. Fixed in 1b3225f11b7bb55781ad7927f3ef343bc810a21d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
htslib is a widely used C library designed for reading and writing high-throughput sequencing data. It provides essential functionalities for bioinformatics applications, enabling efficient data manipulation and analysis. However, htslib has recently been identified as vulnerable to a global buffer overflow, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability stems from a global buffer overflow in the function cram_decoder_init within the htslib package. This issue was reported through OSS-Fuzz, indicating that it allows for reading beyond the allocated memory buffer, potentially leading to crashes or exploitation by attackers. The affected code paths include cram_decode_compression_header and cram_next_slice, which are critical for decoding compressed data. If exploited, this vulnerability could compromise the integrity and availability of applications relying on htslib.
How To Fix
Minimum fixed version
1b3225f11b7bb55781ad7927f3ef343bc810a21d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the functions that trigger the vulnerability until the package is updated. This may involve modifying the application code to bypass calls to cram_decoder_init, cram_decode_compression_header, and cram_next_slice.
Conclusion
The global buffer overflow vulnerability in the htslib package poses significant risks to applications that rely on this library for processing sequencing data. It is crucial for developers to update to the patched version to mitigate these risks and ensure the security and stability of their applications.
See every vulnerability recorded for htslib →
FAQ
A global buffer overflow occurs when a program writes more data to a buffer than it can hold, leading to adjacent memory being overwritten. This can cause crashes or allow attackers to execute arbitrary code.
If your application uses the htslib package and is vulnerable, it may crash or be susceptible to exploitation, compromising data integrity and security.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, Vulert can help you identify if your application is affected by this vulnerability.
If immediate updates are not possible, consider implementing the suggested workaround to avoid using the vulnerable functions until a proper fix can be applied.
Detailed information about this vulnerability can be found in the OSS-Fuzz report and the htslib GitHub repository, where the patch and affected versions are documented.
References
Related vulnerabilities
Recent vulnerabilities recorded for htslib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
