Skip to content
OpenAdvisories
High RLSA-2026:24545 1 CVE

Important: libyang security update

Published Jun 11, 2026 · Updated Jun 11, 2026

Ecosystem: Rocky Linux

Summary

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.

Security Fix(es):

* libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 libyang 0:1.0.184-2.el8_10

Vulnerabilities 1

  • High 7.5
    CVE-2026-44673

    libyang: lyb_read_string() integer overflow → heap buffer overflow

    libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB …

    CESNET libyang libyang libyang2 Debian Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477617