HDF5 2.2.0 Now Available
The HDF Group is pleased to announce the release of HDF5 2.2.0, delivering improved cloud performance, stronger security capabilities, enhanced build and deployment workflows, and numerous reliability and usability improvements across the HDF5 ecosystem.
This release focuses on making HDF5 easier to deploy, more secure in production environments, and more efficient when working with cloud-hosted and large-scale scientific datasets.
Get HDF5 2.2.0
- Download HDF5 2.2.0 – View Release and Download
- Documentation: HDF5 Documentation Portal
We encourage all HDF5 users to review the release materials and documentation and evaluate upgrading to take advantage of the latest enhancements and improvements.
Two August Events You Can’t Miss
Two August events will focus on making HDF5 more transparent, inspectable, and secure.
At FOSSY 2026, The HDF Group’s Gerd Heber will present “A GNU poke-based, machine-readable HDF5 file-format specification.”
FOSSY 2026, Thursday, August 6, 2026, 3:00–3:45 PM PDT, room MCLD 2018, Vancouver: https://2026.fossy.ca/schedule/presentation/421/
The following week, the HDF5 SHINES / Safe-OSE workshop at SSDBM 2026 will bring together HDF5 developers, users, integrators, security practitioners, administrators, data managers, and researchers to discuss risks, audit findings, mitigation priorities, and practical next steps. Remote participation is available for the workshop. Registration is required!
SSDBM 2026, SHINES/Safe-OSE workshop, Wednesday, August 12, 2026, 2:00-5:30 PM PDT, San Diego Supercomputer Center, UC San Diego or remote participation via Zoom: https://ssdbm.org/2026/workshop-safe-ose
Registration: https://ssdbm.org/2026/register. Early registration ends Friday, July 31, 2026. After Friday, the registration fee goes up.
See you there!
What’s New in 2.2.0
Faster Access to Data Stored in S3!
A major enhancement in HDF5 2.2.0 is the addition of an I/O block cache for the ROS3 Virtual File Driver (VFD). By reducing the number of requests sent to Amazon S3 for files that do not use paged allocation, applications can achieve more efficient cloud-based data access with fewer network transactions and improved overall performance.
Additional optimizations delay initial file caching until the first read operation, reducing file-open overhead.
Enhanced Security with Signed Plugin Support
HDF5 2.2.0 introduces optional digital signature verification for dynamically loaded plugins. Organizations can now cryptographically verify plugins before loading them, helping protect scientific and production environments from unauthorized or modified plugin binaries.
A new h5sign utility allows developers to sign plugin libraries using RSA signatures, while configurable keystores support trusted-key management and signature revocation.
Simpler Builds and Easier Deployment
This release continues HDF5’s modernization efforts with several improvements to the CMake build system:
- Documentation has been consolidated into a new top-level docs/ directory.
- External builds now use upstream versions of zlib, zlib-ng, and libaec without requiring patching.
- New CMake modules simplify discovery of zlib-ng and libaec installations.
- Filter library handling has been enhanced to improve configuration flexibility and portability.
These updates make it easier for developers, package maintainers, and system administrators to build and deploy HDF5 across a variety of environments.
Performance Improvements Across HDF5 Tools
Several commonly used HDF5 tools, including h5dump, h5ls, h5diff, h5repack, h5stat, and h5format_convert, have been optimized for files containing large numbers of multiply-linked objects.
Internal data structure improvements significantly reduce traversal overhead and can dramatically improve performance for complex file hierarchies.
Reliability and Quality Improvements
HDF5 2.2.0 includes an extensive collection of bug fixes, security hardening measures, and robustness improvements throughout the library, tools, and high-level APIs. These changes address issues ranging from memory safety and resource management to metadata handling, ROS3 interoperability, data filter validation, and file format decoding.
Together, these enhancements improve reliability when working with large-scale scientific datasets, cloud object storage, and long-lived production deployments.
Security Vulnerability Fixes
HDF5 2.2.0 remediates three reported security vulnerabilities:
- CVE-2025-9274 – Prevents application crashes caused by invalid callback handling during attribute iteration.
- CVE-2026-17572 – Fixes a heap buffer overflow that could be triggered by a corrupted or malicious shared message list.
- CVE-2026-17574 – Improves validation of variable-length datatype metadata to prevent crashes caused by malformed files.
In addition, HDF5 2.2.0 also incorporates the fix for CVE-2026-17573, carrying forward the correction first delivered in HDF5 2.1.0 so that users of the latest release continue to benefit from the update. The fix addresses a double-free vulnerability that could cause an application using h5repack to abort when processing a specially crafted HDF5 file containing an oversized chunk-size field.
Together, these fixes improve the robustness of HDF5 when processing untrusted or corrupted data and further strengthen the library’s overall security posture.
Migration and Compatibility
As a minor release, HDF5 2.2.0 is backward compatible with 2.1.1. It continues the transition to CMake-only builds, so users who have not yet migrated their build scripts from Autotools should refer to our 2.0.0 Migration Guide
Most applications should upgrade to HDF5 2.2.0 without modification, but users should note several compatibility-related changes:
- GitHub release tags now follow Semantic Versioning (Major.Minor.Patch).
- Several legacy CMake variables have been deprecated in favor of updated naming conventions.
- ROS3 users should no longer pass pre-encoded object keys when accessing S3 objects.
- API compatibility handling has been improved for applications targeting older HDF5 API versions.
Organizations with custom build systems or deployment workflows are encouraged to review the release notes before upgrading. See the full CHANGELOG.
We would like to thank the community members whose contributions and feedback helped shape this update. If you have questions, please contact us at help@hdfgroup.org.
Thank you for using HDF5!
* This material is based upon work supported by the U.S. National Science Foundation under Federal Award No. 2534078. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.