We have released HDF5-SHINES-2026-001, the HDF5 Audit Report, by Gerd Heber of The HDF Group and Elena Pourmal of Lifeboat, LLC.
The report is a targeted, ecosystem-level technical assessment of safety, security, and privacy risks across the HDF5 software and data ecosystem. It examines the core library and file format, command-line tools, VOL connectors, filter plugins, VFDs, selected language bindings and applications, the software supply chain, independent implementations, and long-term data accessibility.
Its central conclusion is direct:
HDF5 input is not necessarily inert data.
File-controlled metadata can influence memory allocation, traversal, external-resource access, plugin loading, deserialization, storage behavior, and disclosure. The component that supplies and controls the relevant authority owns the corresponding policy boundary. The presence of HDF5 in an incident does not automatically make that incident a core-library or file-format defect.
Four themes run through the report:
-
Historically, affected core and tool paths repeatedly trusted file-derived sizes, counts, offsets, and state too early. Patching known defects is necessary, but eliminating the class requires explicit invariants, checked arithmetic, validation before object construction, permanent regression tests, and structure-aware fuzzing.
-
Applications can turn documented HDF5 capabilities into attack mechanisms when they process untrusted files while holding filesystem, plugin-loading, deserialization, or resource authority.
-
Reader acceptance, format conformance, and deployment safety are separate decisions. A file opening successfully does not prove that it is consistent or safe for a particular deployment.
-
Privacy harm can occur during correct, authorized operation because payload protection does not necessarily protect metadata, structure, derived information, caches, logs, or workflow artifacts.
The report also examines safety failures that require no adversary, including storage exhaustion during writes, abrupt termination, reader/writer disagreement, and the loss of access to archived data when required non-core filters disappear.
It registers 14 formal findings, seven Rated and seven Provisional, plus four observations that remain in an evidence backlog. These counts are not a prevalence estimate or an HDF5-wide score. The single Immediate response route is conditional and applies to an equivalent service that still follows file-selected external resources while holding access to sensitive local files. The report assigns no Immediate action to The HDF Group in this revision.
Read the full report: https://www.hdfgroup.org/wp-content/uploads/2026/09/HDF5_SHINES_2026_001.pdf
Read the shorter blog overview: HDF5 beyond the file: findings from our safety, security, and privacy audit - The HDF Group - ensuring long-term access and usability of HDF data and supporting users of HDF technologies
We welcome corrections, contrary evidence, deployment experience, and help with the proposed mitigation work. Particularly useful contributions include:
-
affected version and configuration data;
-
storage-exhaustion, crash-recovery, and durability experience;
-
dependencies on non-core filters, VFDs, and VOL connectors;
-
examples of metadata or workflow-artifact disclosure;
-
reader/writer and specification-conformance cases;
-
volunteers willing to help turn proposed roadmap roles into named owners and testable acceptance criteria.
Please keep undisclosed vulnerability details out of this public thread. Submit those through https://github.com/HDFGroup/hdf5/security/advisories/new.
This work was supported by the U.S. National Science Foundation under Federal Award No. 2534078. The findings and recommendations are those of the authors and do not necessarily reflect the views of the National Science Foundation.