HDF5

Most CVEs don’t have identified patches, upstream makes little effort at identifying CVEs in commits, and merges huge changesets from develop to stable branches in single commits.

They have reproducers though at:

https://github.com/HDFGroup/cve_hdf5/

Copyright (C) 2025 Sylvain Beucler