Summary
Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.
Security Fix(es):
* libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | libyang | 2.1.148-1.el9_8.1 |
| AlmaLinux · 9 | libyang-devel | 2.1.148-1.el9_8.1 |
| AlmaLinux · 9 | libyang-devel-doc | 2.1.148-1.el9_8.1 |
Vulnerabilities 1
-
High 7.5
libyang: lyb_read_string() integer overflow → heap buffer overflow
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB …