{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"hdf5","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQWVNXR0H9FE1P8DRJK8DV","modified_at":"2026-10-24T09:47:23.563923602Z","published_at":"2026-08-05T23:16:53.343Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-19024","https://security-tracker.debian.org/tracker/CVE-2026-19024"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-19024#Debian:14/hdf5","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-19024"}],"summary":"NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the \"defined\" flag set togeth"}