Critical Security Update for libyang: CVE-2026-44673 Vulnerability
Summary
RHSA-2026:65508: Red Hat Security Advisory: libyang security update. Affects libyang versions < 0:2.1.148-1.el9_6.1. Fixed in 0:2.1.148-1.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libyang is a powerful library used for parsing and manipulating YANG data models in network management applications. It provides essential functionalities for developers to work with YANG schemas, enabling efficient data handling and configuration management. However, recent findings have revealed a security vulnerability that could potentially impact the integrity and availability of applications utilizing this library.
Vulnerability Detail
The vulnerability identified as CVE-2026-44673 in libyang arises from insufficient validation of input data, which could allow an attacker to exploit the library through crafted YANG models. This could lead to denial of service (DoS) conditions, impacting the availability of services relying on libyang. The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention from users and administrators.
How To Fix
Minimum fixed version
0:2.1.148-1.el9_6.1
This is the first release that contains the fix.
sudo dnf update libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling features that utilize libyang until the package can be updated. However, this is not a long-term solution and updating the package is strongly advised.
Conclusion
The libyang library has a critical vulnerability (CVE-2026-44673) that requires immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with this vulnerability. Regular monitoring and updates are essential to maintain the security of applications.
See every vulnerability recorded for libyang →
FAQ
CVE-2026-44673 is a security vulnerability in the libyang library that allows for potential denial of service attacks through crafted YANG models.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability could lead to service disruptions and potential exploitation by attackers, compromising the availability of applications using libyang.
Yes, a patch is available in the form of an updated libyang package version 0:2.1.148-1.el9_6.1.
The CVSS score for CVE-2026-44673 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
