Null-Dereference READ Vulnerability in htslib Package
Summary
OSV-2026-882: Null-dereference READ in cram_decoder_init. Affects htslib versions >= d926270f580aa64fab4634859d4518d2d7a5dd7e, < 1b3225f11b7bb55781ad7927f3ef343bc810a21d. Fixed in 1b3225f11b7bb55781ad7927f3ef343bc810a21d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
htslib is a widely used C library designed for reading and writing genomic data formats, particularly those associated with high-throughput sequencing. It provides essential functionalities for bioinformatics applications, enabling efficient data manipulation and analysis. However, like any software, it is susceptible to vulnerabilities that can compromise its integrity and reliability.
Vulnerability Detail
The vulnerability identified in htslib is a null-dereference READ that occurs during the initialization of the cram decoder. This issue arises when the function 'cram_decoder_init' attempts to access a null pointer, leading to a crash. The vulnerability was reported through OSS-Fuzz, highlighting its potential to disrupt applications relying on htslib for genomic data processing. If exploited, this vulnerability could result in application crashes, data loss, or unintended behavior, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
1b3225f11b7bb55781ad7927f3ef343bc810a21d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionalities that trigger the null-dereference READ until they can update to the patched version. This may involve modifying their code to bypass the use of the cram decoder or implementing additional checks to prevent null pointer dereferences.
Conclusion
The null-dereference READ vulnerability in the htslib package poses significant risks to applications relying on this library for genomic data processing. It is crucial for users to update to the patched version to ensure the integrity and reliability of their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for htslib →
FAQ
A null-dereference READ occurs when a program attempts to read data from a memory location that has not been properly initialized, leading to crashes or undefined behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The consequences include application crashes, data loss, and potential security risks if the vulnerability is exploited by malicious actors.
Yes, you should upgrade to the fixed version 1b3225f11b7bb55781ad7927f3ef343bc810a21d to mitigate the vulnerability.
If immediate updates are not possible, consider implementing workarounds such as avoiding the use of the affected functionalities until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for htslib.
