Bundled version of libpng has CVE-2026-22801
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1k
- Avg merge
- 22h 17m
- Merged PRs (30d)
- 3
Description
After installing opencv-python-headless and opencv-contrib-python via Poetry on Linux x86_64, I find the following libpng shared objects:
.venv/lib/python3.13/site-packages/opencv_python_headless.libs/libpng16-04239421.so.16.48.0
.venv/lib/python3.13/site-packages/opencv_contrib_python.libs/libpng16-1bde1c40.so.16.43.0
Versions of libpng between 1.6.26 and 1.6.53 (inclusive) have CVE-2026-22801. Searching the opencv GitHub organization for libpng, the only version numbers I see are vulnerable.
Could you please upgrade the bundled versions of libpng to 1.6.54 and make new OpenCV releases? This would be very helpful, as automated vulnerability scanners are currently flagging this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the packaging and CI toolchain that produces the opencv-python-headless and opencv-contrib-python wheels, then trace where the bundled libpng versions in the reported .libs paths are selected. Rebuild and verify the relevant Linux x86_64 packages contain libpng 1.6.54 and that new releases no longer expose the vulnerable versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- build-system, release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100