Description
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | libyang | libyang all versions before 1.0-r5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libyang | 0.16.105-2 | — |
| Debian 13 | libyang | 0.16.105-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | libyang | 0.16.105-3.el8_1.2 | RHSA-2019:4360 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | libyang | 0.16.105-3.el8_1.2 | ELSA-2019-4360 |
Advisories 2
- RHSA-2019:4360 Red Hat Security Advisory: libyang security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-4360 Important: libyang security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 24, 2019
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334
- https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6
- FEDORA-2019-dfe0b42bc5 vendor-advisory
- FEDORA-2019-9d83929ffa vendor-advisory
- RHSA-2019:4360 vendor-advisory