Critical Security Advisory: libyang Vulnerability CVE-2026-44673
Summary
RHSA-2026:65467: Red Hat Security Advisory: libyang security, bug fix, and enhancement update. Affects libyang versions < 0:2.1.148-1.el9_4.1. Fixed in 0:2.1.148-1.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libyang is a C library used for parsing, manipulating, and printing YANG data models. It is widely utilized in network management applications and services. The library provides essential functionalities for developers working with network configurations and protocols. However, recent updates have revealed a security vulnerability that could potentially affect the integrity and availability of applications relying on this library.
Vulnerability Detail
The vulnerability identified as CVE-2026-44673 in libyang arises from improper handling of certain inputs, which could lead to denial of service (DoS) conditions. Attackers may exploit this vulnerability to crash applications that utilize the library, thereby disrupting services. The CVSS score of this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention from users and administrators of affected systems.
How To Fix
Minimum fixed version
0:2.1.148-1.el9_4.1
This is the first release that contains the fix.
sudo dnf update libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to applications utilizing libyang or implement input validation to mitigate the risk of exploitation until the package is updated. However, the most effective solution is to apply the patch as soon as possible.
Conclusion
The libyang vulnerability CVE-2026-44673 poses a significant risk to applications that rely on this library. Users are strongly advised to update to the patched version to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libyang →
FAQ
CVE-2026-44673 is a security vulnerability in the libyang library that could lead to denial of service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing input validation and limiting access to affected applications as a temporary workaround.
More information about libyang can be found on its official documentation and repositories, which detail its functionalities and usage.
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
