Critical Security Update for Yggdrasil: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2026:69308: Important: yggdrasil security update. Affects yggdrasil versions < 0.4.9.2-1.el10_2.3. Fixed in 0.4.9.2-1.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to designated child worker processes. It utilizes a D-Bus message broker for data exchange, making it essential for applications that rely on efficient message handling. However, recent vulnerabilities have been identified that could lead to denial of service, impacting the reliability of applications using Yggdrasil.
Vulnerability Detail
The vulnerabilities stem from various components of the Go programming language utilized by Yggdrasil. These include a denial of service via maliciously-crafted MIME headers, excessive recursion in ASN.1 unmarshalling, quadratic complexity in path resolution, indefinite KeyUpdate messages in TLS, and XML decoding recursion depth issues. Each of these vulnerabilities can be exploited to cause service interruptions, potentially leading to significant downtime and loss of functionality for dependent applications.
How To Fix
Minimum fixed version
0.4.9.2-1.el10_2.3
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the exposure of the Yggdrasil service to trusted networks only, and implement strict input validation to mitigate the risk of exploitation until the packages can be updated.
Conclusion
The recent vulnerabilities in Yggdrasil highlight critical security concerns that could lead to denial of service. It is essential for users to update their packages to the latest patched version to ensure the security and reliability of their applications. Implementing workarounds can provide temporary relief while updates are being applied.
See every vulnerability recorded for yggdrasil →
FAQ
Yggdrasil is a system daemon that manages data routing between MQTT topics and worker processes, utilizing D-Bus for communication.
The vulnerabilities include denial of service issues related to MIME headers, ASN.1 unmarshalling, path resolution, TLS KeyUpdate messages, and XML decoding.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
If immediate updates are not possible, implement network restrictions and input validation as temporary workarounds to minimize risk.
For detailed information, refer to the CVE pages associated with the vulnerabilities listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
