CVE-2025-0838: Critical Heap Overflow in Abseil-cpp Hash Containers

CVE-2025-0838 is a critical heap buffer overflow (CVSS 9.8) in Abseil-cpp hash containers. Upgrade past commit 5a0e2cb5 and rebuild anything that links it. Debian 11 users should install abseil 0~20200923.3-2+deb11u1.

What's affected

• Product: Abseil-cpp, Google's open source C++ library. Debian Linux appears in the record too.
• Components: the sized constructors, reserve() and rehash() of absl::flat_hash_set, flat_hash_map, node_hash_set and node_hash_map.
• Weakness: CWE-190, integer overflow.
• Upstream fix: commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1, dated 23 January 2025. The advice in the record is to upgrade past that commit.
• Debian 11 bullseye: fixed in abseil 0~20200923.3-2+deb11u1, per Debian LTS advisory DLA-4116-1 of 5 April 2025.
• Upstream release label: not confirmed here. Check the Abseil release notes for the first tag after the commit.
• CISA KEV: not listed.

The CVSS vector is network, low complexity, no privileges and no user interaction. Treat that as the worst case. Whether a given program is exposed depends on whether an outsider can influence the size passed to these containers.

How to check if you're exposed

Abseil is a build time dependency for many projects, and it is often vendored, so a package list alone will miss copies.

1. On Debian systems, run dpkg -l | grep -i abseil or apt policy libabsl-dev and compare with the fixed version above.
2. Search your source trees and build files for abseil-cpp, absl/, Bazel WORKSPACE or MODULE.bazel entries, CMake FetchContent calls and git submodules.
3. For each match, find the commit or tag in use and check whether it is before the fix commit.
4. Grep for calls that pass a size into these containers, for example reserve(, rehash( and the sized constructors, and ask where the number comes from. If the number can come from a network message or a file, that call is the one to examine first.
5. Check prebuilt binaries and container images too. A static link keeps the old code inside the binary.

You can also run the free in-browser dependency scan on a manifest, though vendored C++ sources still need a manual search.

What to do now

1. Update Abseil to a revision that includes the fix commit, or install the patched distribution package.
2. Rebuild and redeploy every program that links Abseil statically or vendors it.
3. Where you cannot update yet, cap sizes at your own boundary. Reject any requested container size that comes from untrusted input and exceeds a sane maximum.
4. Make sure your build uses hardening flags such as stack protection and address space layout randomization where your toolchain supports them.
5. Record where Abseil lives in your inventory so you can answer the next advisory quickly.

Why it matters

An integer overflow happens when arithmetic wraps around. Here, a very large size could overflow when the library worked out how much memory to reserve. The container then ended up with less memory than it believed it had, and later writes went past the end. That is a heap buffer overflow, and it can corrupt data or give an attacker control over what the program does next.

The upstream fix has two parts. It changes max_size() to report the real maximum number of items. It also checks the size passed to constructors, reserve() and rehash() and aborts the program on an invalid value. Aborting is a deliberate choice: a crash is better than silent memory corruption.

Libraries like this reach deep into the stack. A bug in one container class can affect thousands of programs that never mention it in their own code. That is the case for tracking transitive and vendored components, and for using reachability analysis to learn which of them take outside input.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Abseil fix commit
• Debian LTS advisory DLA-4116-1
• NVD record for CVE-2025-0838

Last reviewed: 19 October 2026.