Moderate Security Vulnerability in libsolv Package: Buffer Overflow Issues
Summary
ALSA-2026:28236: Moderate: libsolv security update. Affects libsolv versions < 0.7.33-5.el10_2.alma.1. Fixed in 0.7.33-5.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsolv is a library designed for resolving package dependencies using a satisfiability algorithm. It is widely used in package management systems to ensure that software dependencies are correctly handled. The library's functionality is crucial for maintaining the integrity and reliability of software installations. However, recent vulnerabilities have been identified that could potentially compromise the security of systems using this library.
Vulnerability Detail
The vulnerabilities in libsolv stem from multiple buffer overflow issues. Specifically, there is a stack-based buffer overflow in the Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150). Additionally, a heap buffer overflow occurs in the repo_add_solv function due to a negative maxsize from a crafted .solv file (CVE-2026-9149). Lastly, unchecked decompression of malicious .solv page data leads to another heap buffer overflow in the repopagestore function (CVE-2026-48864). These vulnerabilities could allow attackers to execute arbitrary code, leading to potential system compromise.
How To Fix
Minimum fixed version
0.7.33-5.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update libsolvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functionalities of libsolv until the package is updated. However, it is highly recommended to apply the patch as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
In summary, the libsolv package has been identified with moderate security vulnerabilities that could lead to severe consequences if exploited. It is crucial for users to update to the latest patched version to ensure the security of their systems.
See every vulnerability recorded for libsolv →
FAQ
libsolv is a library that resolves package dependencies using a satisfiability algorithm, essential for package management.
The vulnerabilities include stack-based and heap buffer overflows that could allow arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid using the affected functionalities of libsolv as a temporary workaround.
For more details, refer to the CVE pages: CVE-2026-48864, CVE-2026-9149, and CVE-2026-9150.
Related vulnerabilities
Recent vulnerabilities recorded for libsolv.
