Critical Security Flaw in Yggdrasil: IPv6 Host Literal Parsing Issue
Summary
RLSA-2026:11413: Important: yggdrasil security update. Affects yggdrasil versions < 0:0.4.8-4.el10_1. Fixed in 0:0.4.8-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to designated child 'worker' processes. It communicates with these worker processes via a D-Bus message broker, making it integral for applications that rely on real-time data exchange. However, a recent vulnerability has been identified that affects its ability to correctly parse IPv6 host literals, potentially leading to security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, stems from an incorrect parsing of IPv6 host literals within the net/url package used by Yggdrasil. This flaw can allow malicious actors to exploit the system by sending specially crafted data that may lead to unauthorized access or data manipulation. The ramifications of this vulnerability are significant, as it could compromise the integrity and confidentiality of the data being processed by Yggdrasil, leading to severe security implications for applications relying on this daemon.
How To Fix
Minimum fixed version
0:0.4.8-4.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Yggdrasil service or implement network-level controls to limit exposure to potential attacks until the update can be applied.
Conclusion
The identified vulnerability in Yggdrasil poses a significant risk due to its incorrect parsing of IPv6 host literals. It is crucial for users to update to the latest patched version to mitigate potential security threats. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for yggdrasil →
FAQ
CVE-2026-25679 is a security vulnerability in Yggdrasil that involves incorrect parsing of IPv6 host literals, which can be exploited by attackers.
This vulnerability can lead to unauthorized access or manipulation of data processed by Yggdrasil, potentially compromising your application's security.
If an immediate update is not possible, consider implementing network-level controls to limit access to the Yggdrasil service as a temporary workaround.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
