Critical Security Update for Yggdrasil: Addressing IPv6 Parsing and TLS Denial of Service Vulnerabilities
Summary
ALSA-2026:19126: Important: yggdrasil security update. Affects yggdrasil versions < 0.4.9-4.el10_2. Fixed in 0.4.9-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to various child 'worker' processes. It utilizes a D-Bus message broker for data exchange, making it integral for applications requiring efficient message handling. However, recent vulnerabilities have been identified that could compromise its security and functionality.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, an incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679), which could lead to misrouting of data or exposure to malicious inputs. Second, a Denial of Service vulnerability in the crypto/tls package (CVE-2026-32283) allows attackers to exploit multiple TLS 1.3 key update messages, potentially overwhelming the server and disrupting service. These vulnerabilities can severely impact the reliability and security of applications relying on Yggdrasil.
How To Fix
Minimum fixed version
0.4.9-4.el10_2
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the use of IPv6 in your application until the update can be applied. This can be done by modifying your network configuration settings to prefer IPv4 over IPv6.
Conclusion
The recent vulnerabilities identified in Yggdrasil pose significant risks to applications relying on its functionality. It is crucial to apply the available updates promptly to mitigate these risks and ensure the security and reliability of your systems.
See every vulnerability recorded for yggdrasil →
FAQ
The vulnerabilities include incorrect parsing of IPv6 host literals and a Denial of Service issue related to TLS 1.3 key updates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
These vulnerabilities can lead to misrouting of data and potential service disruptions, affecting the reliability of applications using Yggdrasil.
Yes, a patch is available in version 0.4.9-4.el10_2 for both Yggdrasil and Yggdrasil-devel packages.
Consider disabling IPv6 in your application as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
