AZL-113495: CVE-2026-34017 affecting package hyperscan 5.4.2-3
Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hyperscanto a version that resolves this vulnerability.Fixed in 5.4.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
User applications using affected Hyperscan versions before v5.4.2.1 may be exposed. The described impact is denial of service, with high impact to availability and low impact to integrity.
What does an attacker need to exploit it?
The attacker is described as unprivileged and unauthenticated, using a low-complexity attack through local access. Exploitation requires the stated attack requirements and passive user interaction, but does not require special internal knowledge.
What is the recommended remediation?
Update Hyperscan to v5.4.2.1 or later, since versions before v5.4.2.1 are identified as affected.