Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

HTSlib and samtools through 1.24 patched; CVE IDs pending

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Robert Davies disclosed multiple flaws in HTSlib and samtools through 1.24; fixes are out and CVE IDs remain pending.

Robert Davies posted on oss-security on October 27 that HTSlib and samtools through version 1.24 contain multiple vulnerabilities. The issues are fixed in release 1.25 and back-ported to 1.24.1, 1.23.3, 1.22.4 and 1.21.3 for both packages. CVE numbers are not yet available because GitHub, the assigning authority, has a long backlog; linked GitHub pages are expected to update once IDs exist. The available posts do not describe the individual flaws.

Key facts
  • Robert Davies disclosed the issues on oss-security on October 27.
  • Affected ranges are HTSlib <= 1.24 and samtools <= 1.24.
  • Fixes are 1.25 plus 1.24.1, 1.23.3, 1.22.4 and 1.21.3.
  • GitHub has not assigned CVE numbers yet because of a backlog.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026Davies disclosed multiple HTSlib flaws through 1.24 · oss-security
  2. Oct 27, 2026Davies disclosed multiple samtools flaws through 1.24 · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityHTSlib <= 1.24 fixed in 1.25 and four back-ports
  • oss-securitysamtools <= 1.24 fixed on the same version set
Products
samtoolsHTSlib
Organizations
GitHub

Coverage

oldest first · one row per article · UTC
  1. · 3d ago oss-securityFirst report

    HTSlib through 1.24 fixed in 1.25 and backports

    The same release set back-ports fixes to 1.24.1, 1.23.3, 1.22.4 and 1.21.3 while CVE IDs remain pending.

  2. · 3d ago oss-security

    samtools through 1.24 fixed in 1.25 and backports

    Fixes were also back-ported to 1.24.1, 1.23.3, 1.22.4 and 1.21.3; CVE numbers are not assigned yet.