Critical Security Update for Yggdrasil: Addressing IPv6 Parsing Vulnerability
Summary
ALSA-2026:11413: Important: yggdrasil security update. Affects yggdrasil versions < 0.4.8-4.el10_1. Fixed in 0.4.8-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to appropriate child worker processes. It employs a D-Bus message broker for data exchange between the daemon and its worker processes. This functionality is crucial for applications that rely on real-time data communication and processing. However, a recent vulnerability has been identified that affects the parsing of IPv6 host literals, potentially compromising the integrity of data routing.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, stems from an incorrect parsing mechanism in the net/url package used by Yggdrasil. This flaw allows attackers to exploit the system by sending specially crafted IPv6 addresses, which could lead to unauthorized access or manipulation of data being routed through the daemon. The ramifications of this vulnerability could include data leakage, unauthorized command execution, or disruption of service, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
0.4.8-4.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Yggdrasil daemon by implementing firewall rules that limit incoming connections to trusted IP addresses only. This can help mitigate the risk until the package is updated.
Conclusion
In summary, the Yggdrasil package has a critical vulnerability related to IPv6 parsing that needs immediate attention. Users are advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for yggdrasil →
FAQ
CVE-2026-25679 is a vulnerability in the Yggdrasil package that involves incorrect parsing of IPv6 host literals, potentially allowing unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include data leakage, unauthorized command execution, and potential disruption of service due to improper handling of IPv6 addresses.
Yes, a patch is available in the form of an updated version of the Yggdrasil package, specifically version 0.4.8-4.el10_1.
If immediate updates are not possible, implement firewall rules to restrict access to the Yggdrasil daemon as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
