Critical Security Update for libyang: Denial of Service and Code Execution Vulnerability
Summary
ALSA-2026:24545: Important: libyang security update. Affects libyang versions < 1.0.184-2.el8_10. Fixed in 1.0.184-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libyang is a robust YANG data modeling language parser and toolkit implemented in C, providing a comprehensive API for developers to work with YANG models. It is widely used in network management and configuration applications due to its efficiency and flexibility. However, a recent vulnerability has been identified that could potentially compromise the integrity and availability of systems utilizing this library.
Vulnerability Detail
The vulnerability, identified as CVE-2026-44673, allows for a Denial of Service (DoS) or arbitrary code execution through the processing of a maliciously crafted LYB binary blob. This flaw originates from improper handling of input data, which can lead to unexpected behavior in the libyang library. If exploited, an attacker could cause the application to crash or execute arbitrary code, posing significant risks to system security and stability.
How To Fix
Minimum fixed version
1.0.184-2.el8_10
This is the first release that contains the fix.
sudo dnf update libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted LYB binary blobs until the package is updated. This can help prevent potential exploitation of the vulnerability while a permanent fix is being applied.
Conclusion
The libyang library has a critical vulnerability that can lead to Denial of Service and arbitrary code execution. It is essential for users to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for libyang →
FAQ
Libyang is a YANG data modeling language parser and toolkit written in C, used for managing and configuring network devices.
CVE-2026-44673 is a vulnerability in libyang that allows for Denial of Service or arbitrary code execution via maliciously crafted LYB binary blobs.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file, such as package-lock.json.
Exploitation of this vulnerability can lead to application crashes or unauthorized code execution, compromising system security and availability.
Yes, avoid processing untrusted LYB binary blobs as a temporary workaround until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
