Critical Security Flaw in yggdrasil-worker-package-manager: IPv6 Host Literal Parsing Issue
Summary
RLSA-2026:11412: Important: yggdrasil-worker-package-manager security update. Affects yggdrasil-worker-package-manager versions < 0:0.2.3-5.el10_1. Fixed in 0:0.2.3-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yggdrasil-worker-package-manager is a lightweight package manager designed for yggd workers. It facilitates the installation and removal of software packages, as well as managing repositories. The package manager employs basic detection mechanisms to identify the host environment and determine the appropriate package manager to utilize. However, it has been found to have a critical vulnerability related to the parsing of IPv6 host literals, which could lead to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, arises from incorrect parsing of IPv6 host literals within the net/url package. This flaw can potentially allow attackers to exploit the package manager's functionality, leading to unauthorized access or manipulation of system resources. The ramifications of this vulnerability are significant, as it could compromise the integrity and security of the systems utilizing this package manager.
How To Fix
Minimum fixed version
0:0.2.3-5.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasil-worker-package-managerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the usage of the yggdrasil-worker-package-manager until the update is applied. Additionally, avoid using IPv6 addresses in configurations that involve the package manager until the vulnerability is resolved.
Conclusion
The yggdrasil-worker-package-manager has a critical vulnerability related to IPv6 host literal parsing, which poses significant security risks. Users are urged to update to the patched version to ensure the security of their systems. For those unable to update immediately, temporary workarounds should be implemented.
See every vulnerability recorded for yggdrasil-worker-package-manager →
FAQ
CVE-2026-25679 is a vulnerability in the yggdrasil-worker-package-manager that involves incorrect parsing of IPv6 host literals, potentially leading to security breaches.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability could allow unauthorized access or manipulation of system resources, compromising the integrity and security of affected systems.
Yes, a patch is available. Users should update to version 0:0.2.3-5.el10_1 or later to mitigate the vulnerability.
If immediate updating is not possible, consider restricting the use of the yggdrasil-worker-package-manager and avoid using IPv6 addresses in configurations.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil-worker-package-manager.
