Critical Security Update for yggdrasil-worker-package-manager: IPv6 Parsing Flaw
Summary
ALSA-2026:19128: Important: yggdrasil-worker-package-manager security update. Affects yggdrasil-worker-package-manager versions < 0.2.3-6.el10_2. Fixed in 0.2.3-6.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yggdrasil-worker-package-manager is a lightweight package manager designed for yggd workers. It facilitates the installation and removal of software packages, as well as the management of repositories. The tool employs basic detection mechanisms to identify the host environment and determine the appropriate package manager to use. However, it has been found to have a security vulnerability that affects its ability to correctly parse IPv6 host literals.
Vulnerability Detail
The vulnerability arises from an incorrect parsing mechanism in the net/url module of the yggdrasil-worker-package-manager. Specifically, it fails to accurately interpret IPv6 host literals, which could lead to potential security risks such as unauthorized access or data leakage. This flaw is documented under CVE-2026-25679 and poses a significant threat to systems relying on this package for package management.
How To Fix
Minimum fixed version
0.2.3-6.el10_2
This is the first release that contains the fix.
sudo dnf update yggdrasil-worker-package-managerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the yggdrasil-worker-package-manager for managing packages until the update is applied. Alternatively, consider using a different package manager that does not exhibit this vulnerability.
Conclusion
The yggdrasil-worker-package-manager has a critical vulnerability related to IPv6 parsing that requires immediate attention. Users are advised to update to the latest version to mitigate potential security risks. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for yggdrasil-worker-package-manager →
FAQ
The vulnerability involves incorrect parsing of IPv6 host literals, which can lead to security risks.
You can use the Vulert playground at Vulert Scanner to check your application for this vulnerability without needing to sign up.
Update the yggdrasil-worker-package-manager to the latest patched version as soon as possible.
Yes, upgrade to version 0.2.3-6.el10_2 or later to ensure the vulnerability is patched.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil-worker-package-manager.
