Description
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libyang | 1.0.176-1 | — |
| Debian 13 | libyang | 1.0.176-1 | — |
| Debian 10 | libyang | 0.16.105+really1.0-0+deb10u1 | DLA-3572-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libyang | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | libyang | 1.0.184-1.el8 | RHEA-2021:1906 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | libyang | 1.0.184-1.el8 | ALEA-2021:1906 |
Advisories 3
- ALEA-2021:1906 libyang bug fix and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- DLA-3572-1 libyang - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHEA-2021:1906 Red Hat Enhancement Advisory: libyang bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be5
- https://github.com/CESNET/libyang/issues/723
- https://bugzilla.redhat.com/show_bug.cgi?id=1793922
- https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
- [debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update mailing-list