Critical Security Update for yggdrasil: Addressing Denial of Service and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:5146: Important: yggdrasil security update. Affects yggdrasil versions < 0.4.8-3.el10_1. Fixed in 0.4.8-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to various child 'worker' processes. It communicates with these worker processes through a D-Bus message broker, making it essential for efficient data handling in distributed systems. However, recent vulnerabilities have been identified that could compromise its functionality and security.
Vulnerability Detail
The vulnerabilities in yggdrasil stem from issues in its underlying libraries, specifically in the crypto/x509 and net/url packages. The first vulnerability (CVE-2025-61729) allows for Denial of Service (DoS) attacks due to excessive resource consumption caused by crafted certificates. The second vulnerability (CVE-2025-61726) leads to memory exhaustion during query parameter parsing. Lastly, CVE-2025-68121 involves unexpected session resumption in the crypto/tls package, which could lead to unauthorized access or data leakage. These vulnerabilities pose significant risks, including service interruptions and potential data breaches.
How To Fix
Minimum fixed version
0.4.8-3.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the input size for certificates and query parameters to mitigate the risk of resource exhaustion until the update can be applied. Additionally, monitor the application closely for any unusual behavior.
Conclusion
The vulnerabilities in yggdrasil pose significant risks to system security and performance. It is essential to update to the latest patched version to mitigate these risks. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for yggdrasil →
FAQ
yggdrasil is a system daemon that routes data between an MQTT broker and worker processes, facilitating efficient data handling in distributed systems.
The main vulnerabilities include Denial of Service due to crafted certificates, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement input size restrictions and monitor the application for unusual activity as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
