Red Hat Security Advisory: libsolv security update

Fixed packages 3

Vulnerabilities 3

• High 7.8
  CVE-2026-48864

  Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

  A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when proc…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  May 26, 2026
• Medium 6.5
  CVE-2026-9149

  Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

  A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequen…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  May 20, 2026
• Medium 6.5
  CVE-2026-9150

  Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

  A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksu…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  May 20, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460380
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460425
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48818.json
• report
  https://access.redhat.com/security/cve/CVE-2026-9149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9149
• article
  https://github.com/openSUSE/libsolv/pull/617
• report
  https://access.redhat.com/security/cve/CVE-2026-9150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9150
• article
  https://github.com/openSUSE/libsolv/pull/616
• report
  https://access.redhat.com/security/cve/CVE-2026-48864
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48864
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48864