Bundled version of libpng has CVE-2026-22801
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- python
- Domain
- build-system, release, security
Research direction
Inspect the packaging and CI toolchain that produces the opencv-python-headless and opencv-contrib-python wheels, then trace where the bundled libpng versions in the reported .libs paths are selected. Rebuild and verify the relevant Linux x86_64 packages contain libpng 1.6.54 and that new releases no longer expose the vulnerable versions.
Written by the indexing model from the issue text.
Description
After installing opencv-python-headless and opencv-contrib-python via Poetry on Linux x86_64, I find the following libpng shared objects:
.venv/lib/python3.13/site-packages/opencv_python_headless.libs/libpng16-04239421.so.16.48.0
.venv/lib/python3.13/site-packages/opencv_contrib_python.libs/libpng16-1bde1c40.so.16.43.0
Versions of libpng between 1.6.26 and 1.6.53 (inclusive) have CVE-2026-22801. Searching the opencv GitHub organization for libpng, the only version numbers I see are vulnerable.
Could you please upgrade the bundled versions of libpng to 1.6.54 and make new OpenCV releases? This would be very helpful, as automated vulnerability scanners are currently flagging this.
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1k
- Avg merge
- 22h 17m
- Merged PRs (30d)
- 3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from opencv/opencv-python
-
[DOC] README file Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
opencv/opencv-python#1217 · 3 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
opencv/opencv-python#1165 · 2 comments · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
opencv/opencv-python#1273 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
opencv/opencv-python#1272 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 70/100
opencv/opencv-python#1268 · 1 comment ·
All issues in opencv/opencv-python
Similar issues
-
triage/confirmed
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
agentscope-ai/agentscope#2775 ·
-
comp/desktop P3 type/bug
Difficulty 1/5 Under an hour Newbie friendliness 92/100
NousResearch/hermes-agent#118866 ·
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/cloudstack#14222 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100