p PatchFirst

CVE-2026-115327

CVE-2026-115327 · libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

CVSS 6.0 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • libyang

    Versions
    • ≥ 0, ≤ 6.4.13: Affected (semver)

    No fix published

  • libyang Debian:13

    Versions
    • 3.12.2-1
    • 3.13.5-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.6-1~bpo13+1
    • 4.2.2-1
    • 4.2.2-2
    • 4.2.2-3
    • 4.3.3-1
    • 4.3.4-1
    • 4.7.3-1
    • 5.0.2-1
    • 5.0.8-1
    • 5.4.1+really5.4.1-1
    • 5.4.1-1
    • 5.4.5-1
    • 5.4.9-1
    • 5.7.1-1
    • 5.8.5-1
    • 5.8.6-1
    • 5.8.6-2
    • 6.1.4-1
    • 6.4.13-1
    • 6.4.3-1
    • 6.4.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Debian:14

    Versions
    • 3.12.2-1
    • 3.13.5-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.6-1~bpo13+1
    • 4.2.2-1
    • 4.2.2-2
    • 4.2.2-3
    • 4.3.3-1
    • 4.3.4-1
    • 4.7.3-1
    • 5.0.2-1
    • 5.0.8-1
    • 5.4.1+really5.4.1-1
    • 5.4.1-1
    • 5.4.5-1
    • 5.4.9-1
    • 5.7.1-1
    • 5.8.5-1
    • 5.8.6-1
    • 5.8.6-2
    • 6.1.4-1
    • 6.4.13-1
    • 6.4.3-1
    • 6.4.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang2 Debian:12

    Versions
    • 2.1.148-0.1
    • 2.1.148-0.2
    • 2.1.30-2
    • 2.1.30-2.1
    • 2.1.30-2.1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:20.04:LTS

    Versions
    • 0.16.105-1
    • 0.16.105-2
    • 0.16.105-3
    • 0.16.105-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:22.04:LTS

    Versions
    • 1.0.225-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang2 Ubuntu:22.04:LTS

    Versions
    • 2.0.112-6
    • 2.0.112-6ubuntu1
    • 2.0.112-6ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang2 Ubuntu:24.04:LTS

    Versions
    • 2.1.30-2
    • 2.1.30-2.1
    • 2.1.30-2.1build1
    • 2.1.30-2.1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:26.10

    Versions
    • 3.13.6-1
    • 3.13.6-1ubuntu1
    • 6.1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:26.04:LTS

    Versions
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.6-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →