Critical Memory Exhaustion Vulnerability in yggdrasil-worker-package-manager
Summary
RLSA-2026:5145: Important: yggdrasil-worker-package-manager security update. Affects yggdrasil-worker-package-manager versions < 0:0.2.3-4.el10_1. Fixed in 0:0.2.3-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yggdrasil-worker-package-manager is a lightweight package manager designed for yggd workers. It facilitates the installation and removal of packages, as well as the management of repositories. The package manager employs basic detection methods to identify the host environment and determine the appropriate package manager to utilize. However, it is susceptible to a significant security flaw that can lead to memory exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2025-61726, arises from a memory exhaustion issue in the net/url package during query parameter parsing. This flaw can be exploited by an attacker to cause the application to consume excessive memory resources, potentially leading to denial of service. The vulnerability is particularly concerning as it affects the stability and availability of the service running yggdrasil-worker-package-manager, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0:0.2.3-4.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasil-worker-package-managerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for query parameters to reduce the risk of memory exhaustion. However, this is not a complete solution and updating the package is strongly recommended.
Conclusion
The memory exhaustion vulnerability in yggdrasil-worker-package-manager poses a significant risk to users, potentially leading to service disruptions. It is crucial to update to the latest patched version to mitigate this risk. Users can also utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for yggdrasil-worker-package-manager →
FAQ
CVE-2025-61726 is a vulnerability in the net/url package that can lead to memory exhaustion during query parameter parsing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, causing the application to become unresponsive due to excessive memory consumption.
Yes, a patched version of yggdrasil-worker-package-manager is available. Users should update to version 0:0.2.3-4.el10_1.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil-worker-package-manager.
