NULL pointer dereference in libyang - #VU163175
Published: November 9, 2026
Vulnerability identifier: #VU163175
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to crash applications using libyang to parse attacker-controlled JSON, causing denial of service.
The vulnerability exists due to a missing NULL check in libyang's sorted-data list comparison when duplicate keys and nested opaque metadata with unqualified attributes produce mismatched list key chains. An unauthenticated attacker can supply crafted JSON to an application that parses untrusted data with sorted-data insertion enabled, terminating its process.
Affected software
libyang
Remediation
Install security update from vendor's website.
libyang - update to 5.8.6