CVE-2026-31965

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31965", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.484Z", "datePublished": "2026-03-18T18:50:37.333Z", "dateUpdated": "2026-03-19T14:52:36.357Z"}, "containers": {"cna": {"title": "HTSlib CRAM reader has out-of-bounds reads due to improper validation of input", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr"}, {"name": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357"}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"version": "< 1.21.1", "status": "affected"}, {"version": ">= 1.22, < 1.22.2", "status": "affected"}, {"version": "= 1.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:50:37.333Z"}, "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "source": {"advisory": "GHSA-mqm2-v645-3qhr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T14:52:21.615286Z", "id": "CVE-2026-31965", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:52:36.357Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T14:52:21.615286Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:52:32.516Z"}}], "cna": {"title": "HTSlib CRAM reader has out-of-bounds reads due to improper validation of input", "source": {"advisory": "GHSA-mqm2-v645-3qhr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "references": [{"url": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr", "name": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "name": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:50:37.333Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31965", "state": "PUBLISHED", "dateUpdated": "2026-03-19T14:52:36.357Z", "dateReserved": "2026-03-10T15:40:10.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T18:50:37.333Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "htslib", "vendor": "samtools", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "A069D6B6-FFF6-4DB7-9811-A568ECC4B288", "versionEndExcluding": "1.21.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9D525C8-C8AD-4368-A396-EB4D9DA02B1C", "versionEndExcluding": "1.22.2", "versionStartIncluding": "1.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "AAA6BBB2-76F3-4372-9BAE-FDE157401EFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}, {"lang": "es", "value": "HTSlib es una biblioteca para leer y escribir formatos de archivo bioinform\u00e1ticos. CRAM es un formato comprimido que almacena datos de alineaci\u00f3n de secuencias de ADN. En la funci\u00f3n 'cram_decode_slice()' llamada al leer registros CRAM, la validaci\u00f3n del campo de ID de referencia ocurri\u00f3 demasiado tarde, permitiendo que ocurrieran dos lecturas fuera de l\u00edmites antes de que se detectaran los datos no v\u00e1lidos. El error permite que se filtren dos valores al llamador, sin embargo, como la funci\u00f3n informa un error, puede ser dif\u00edcil explotarlos. Tambi\u00e9n es posible que el programa falle debido a que intenta acceder a memoria no v\u00e1lida. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. No hay una soluci\u00f3n alternativa para este problema."}], "id": "CVE-2026-31965", "lastModified": "2026-06-17T10:34:51.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31965", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T14:52:21.615286Z", "version": "2.0.3"}}]}, "published": "2026-03-18T19:16:04.823", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "htslib: HTSlib: Information disclosure or denial of service via out-of-bounds read in CRAM record processing", "id": "2448751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448751"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. This vulnerability, an out-of-bounds read, occurs in the `cram_decode_slice()` function when processing CRAM (Compressed Reference-oriented Alignment Map) records due to delayed validation of the reference ID field. A remote attacker could exploit this by providing a specially crafted CRAM file, potentially leading to the disclosure of two memory values or causing the program to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31965", "public_date": "2026-03-18T18:50:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31965\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31965\nhttps://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357\nhttps://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr"], "statement": "MODERATE impact: The HTSlib CRAM reader is vulnerable to out-of-bounds reads due to improper input validation. This flaw can lead to information leakage or application crashes when processing specially crafted CRAM files. This affects components utilizing HTSlib for CRAM file processing, such as htslib and python-pysam in Community Projects (EPEL and Fedora).", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.21.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22,1.22.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "htslib", "vendor": "samtools"}], "analysis": {"en": {"generated_at": "2026-03-19T16:23:36.791711+00:00", "value": {"mitigation_remediation": ["Update htslib to version 1.23.1 or later to apply the official fix."], "summary": {"action": "Apply Patch", "impact": "Memory Corruption"}, "threat_synthesis": {"affected_systems": "Affected products include the htslib library used by SamTools. Versions 1.23.1, 1.22.2, and 1.21.1 are vulnerable. The corresponding CPE strings are cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:* and cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*.", "description_and_impact": "The vulnerability occurs in the cram_decode_slice() function of htslib, where validation of the reference id field happens too late in the decoding process. This allows two out-of-bounds reads that could leak values to the caller or cause a crash when the function attempts to access invalid memory. The primary impact is memory corruption and potential information leakage, categorized under CWE-125 (Out-of-Bounds Read) and CWE-129 (Race Condition, Logical).", "risk_and_exploitability": "The CVSS score of 6.9 indicates a medium severity vulnerability, while the EPSS score of less than 1% denotes a low probability of exploitation. It is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is local or remote if a malicious CRAM file can be supplied to the software; however, a successful exploit requires the ability to provide malformed CRAM data to the application."}}}}, "created": "2026-03-19T08:55:42.719414+00:00", "updated": "2026-03-25T11:52:25.357468+00:00", "vendors": ["samtools", "samtools$PRODUCT$htslib"]}