Linux Distros Unpatched Vulnerability : CVE-2026-115327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes...

CVE-2026-115327

A flaw was found in libyang. An uninitialized pointer free vulnerability occurs during the processing of Network Configuration Protocol NETCONF Remote Procedure Call RPC action envelopes. An authenticated remote attacker with an established NETCONF session can trigger this flaw by sending a...

DEBIAN-CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327

The libyang library (versions through 6.4.13 ) is vulnerable to an uninitialized pointer free vulnerability within the lydxml_env_netconf_rpc() function located in src/parser_xml.c. This issue occurs during the parsing of NETCONF RPC action envelopes . An attacker with an established NETCONF sess...

CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

EUVD-2026-108129

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

PT-2026-121365

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml env netconf rpc in src/parser xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd parse op to crash servers like...

AlmaLinux 9.2 [TuxCare] Security Update: libyang / libyang-devel / libyang-devel-doc (ALMALINUX9.2:CLSA-2026:1786710499)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786710499 advisory. - libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lyspstmtvalidatevalue at...

Rocky Linux 8 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource Multiple Vulnerabilities (crlea-2021_1906)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlea-20211906 advisory. For detailed information on changes in this release, see the Rocky Enterprise Software Foundation Enterprise Linux 8.4 Release Notes linked from the...

Rocky Linux 10.2 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_24758)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624758 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource (crlsa-2026_24545)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624545 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_25051)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625051 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

ANT-2026-573F8CSS · cesnet/libyang · Memory Corruption / Stack Buffer Overflow

stack-buffer-overflow high GHSA-44h9-v855-6rj3 Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-573F8CSS: Stack buffer overflow...

Important: Red Hat Security Advisory: libyang security update

An update for libyang is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lybreadstring function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer such as a...

libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lybreadstring function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer such as a...

Important: Red Hat Security Advisory: libyang security, bug fix, and enhancement update

An update for libyang is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lybreadstring function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer such as a...