CVE-2026-48864

CVE-2026-48864 affects libsolv. The issue is a heap buffer overflow during decompression of attacker-controlled data in .solv files, caused by insufficient input validation in repopagestore. This can lead to out-of-bounds memory access with potential information disclosure, alteration of program ...

CVE-2019-20387

CVE-2019-20387: heap-based buffer over-read in repodata_schema2id() of libsolv (repodata.c) causing potential crash. Affected: Cloud Pak for Security (CP4S) versions 1.8.1.0, 1.8.0.0, 1.7.2.0. Root cause: last schema length shorter than input schema leading to over-read. Remediation: upgrade to C...

CVE-2021-33929

CVE-2021-33929 describes a buffer-overflow vulnerability in libsolv’s pool_disabled_sovable path (src/repo.h) that can trigger a Denial of Service. Affected is libsolv versions before 0.7.17; the root cause is an out-of-bounds write in pool_disabled_sovable, leading to DoS under crafted input. IB...

CVE-2021-33928

CVE-2021-33928 is a buffer overflow in libsolv (function pool_installable in src/repo.h) that allows Denial of Service via out-of-bounds writes in libsolv versions before 0.7.17. The connected IBM bulletin entries corroborate multiple libsolv CVEs in a vendor context, but the specific entry detai...

CVE-2021-33938

CVE-2021-33938 is a buffer/heap-related Denial of Service in libsolv (prune_to_recommended in src/policy.c) where versions before 0.7.17 are affected. The vulnerability arises from a vulnerability in the prune_to_recommended path that could be exploited to cause a DoS. Affected software is libsol...

CVE-2021-33930

CVE-2021-33930 is a buffer overflow/DoS vulnerability in libsolv, specifically in pool_installable_whatprovides within src/repo.h, affecting libsolv before 0.7.17. The IBM security bulletins enumerate this and related CVEs (CVE-2021-33928/33929) under IBM Cloud Pak for Business Automation/AIOps, ...