Critical Security Flaw in libyang: Denial of Service and Code Execution Risk
Summary
ALSA-2026:24758: Important: libyang security update. Affects libyang versions < 2.1.148-4.el10_2. Fixed in 2.1.148-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libyang is a YANG data modeling language parser and toolkit written in C, providing an API for developers to work with YANG data models. It is widely used in network management and configuration applications, making it a crucial component for ensuring data integrity and system functionality. However, it has recently been identified as vulnerable to a significant security issue that could compromise its reliability.
Vulnerability Detail
The vulnerability in libyang arises from its handling of maliciously crafted LYB binary blobs. This flaw can lead to a Denial of Service (DoS) attack or allow arbitrary code execution, posing a severe risk to systems utilizing this library. Attackers can exploit this vulnerability to disrupt services or execute harmful code, potentially leading to data breaches or system failures.
How To Fix
Minimum fixed version
2.1.148-4.el10_2
This is the first release that contains the fix.
sudo dnf update libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of applications using libyang to untrusted inputs, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The libyang security vulnerability poses significant risks, including Denial of Service and arbitrary code execution. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libyang →
FAQ
Libyang is a parser and toolkit for the YANG data modeling language, commonly used in network management applications.
The vulnerability allows for Denial of Service attacks or arbitrary code execution through malicious LYB binary blobs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a workaround, limit the exposure of your applications to untrusted inputs until you can apply the necessary updates.
For detailed information, refer to the CVE page associated with this vulnerability, CVE-2026-44673.
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
