SB20261109221 - Multiple vulnerabilities in libyang

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109221

SB20261109221 - Multiple vulnerabilities in libyang

Published: November 9, 2026

Security Bulletin ID SB20261109221
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to crash applications that compile attacker-controlled YANG schemas with libyang, causing denial of service.

The vulnerability exists due to an unchecked scan length in ly_strnchr() during schema compilation when a leafref path expression begins with whitespace. An attacker can supply a crafted schema with excessive leading whitespace to control how far the scan reads beyond a heap buffer, potentially reaching unmapped memory and crashing the application.


2) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker who controls a YANG schema to crash applications that parse it with libyang, causing denial of service.

The vulnerability exists due to a NULL-pointer dereference in libyang's extension-statement parser when a text-field substatement within an extension instance contains a nested extension instance. An attacker who controls a YANG schema can trigger the crash by having an application parse this crafted input.


3) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to crash applications that use libyang to serialize attacker-controlled data as JSON, causing denial of service.

The vulnerability exists due to a NULL-pointer dereference in libyang's JSON printer when an opaque parent node has an unresolvable namespace. An attacker can supply crafted XML containing that parent and a child with a resolvable namespace to trigger the crash when an application prints the data as JSON.


4) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to crash applications using libyang to parse attacker-controlled JSON, causing denial of service.

The vulnerability exists due to a missing NULL check in libyang's sorted-data list comparison when duplicate keys and nested opaque metadata with unqualified attributes produce mismatched list key chains. An unauthenticated attacker can supply crafted JSON to an application that parses untrusted data with sorted-data insertion enabled, terminating its process.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to crash applications that parse attacker-controlled JSON with libyang, causing denial of service.

The vulnerability exists due to an out-of-bounds heap read in libyang's JSON metadata processing when a metadata block precedes its corresponding data node and contains a schema-recognized child. An unauthenticated attacker can supply such malformed JSON to the public lyd_parse_data() API and trigger a segmentation fault.


6) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to crash applications that parse untrusted YANG schemas with libyang, causing denial of service.

The vulnerability exists due to a heap use-after-free in extension-instance path construction when parsing a YANG type containing multiple pattern statements. An unprivileged local attacker can supply a crafted schema and induce a victim to parse it through lys_parse_mem() or lys_parse(), triggering a freed-memory read and application crash.


Remediation

Install update from vendor's website.

References