Critical Security Flaw in Yggdrasil: Denial of Service and Memory Exhaustion Vulnerabilities
Summary
RLSA-2026:5146: Important: yggdrasil security update. Affects yggdrasil versions < 0:0.4.8-3.el10_1. Fixed in 0:0.4.8-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to appropriate child 'worker' processes. It utilizes D-Bus for communication between the main daemon and its workers. This architecture allows for efficient data handling but also introduces potential vulnerabilities, particularly in the areas of resource management and session handling.
Vulnerability Detail
The vulnerabilities identified in Yggdrasil stem from several issues in its underlying libraries. The first, CVE-2025-61729, involves a Denial of Service (DoS) condition caused by excessive resource consumption when processing crafted certificates. The second, CVE-2025-61726, leads to memory exhaustion during query parameter parsing in the net/url library. Lastly, CVE-2025-68121 presents an unexpected session resumption issue in the crypto/tls library. These vulnerabilities can lead to service interruptions and degraded performance, making systems using Yggdrasil susceptible to attacks that exploit these weaknesses.
How To Fix
Minimum fixed version
0:0.4.8-3.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the resources allocated to Yggdrasil or implement network-level protections to filter out potentially malicious traffic. However, these are not substitutes for applying the necessary updates.
Conclusion
In summary, the Yggdrasil package has critical vulnerabilities that can lead to Denial of Service and memory exhaustion. It is crucial to update to the latest patched version to ensure system security. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for yggdrasil →
FAQ
Yggdrasil is a system daemon that routes data between an MQTT broker and worker processes, utilizing D-Bus for communication.
The main vulnerabilities include a Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing resource limits and network protections as temporary workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
