CVE-2026-122127

CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Ipfixcol2

CVE-2026-122129

CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Ipfixcol2

CVE-2026-122130

CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Ipfixcol2

CVE-2026-63201

netopeer2-server logging has format string vulnerability via subtree filter

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Netopeer2

CVE-2026-41401

libyang - Heap Use-After-Free Write in XML Metadata Parsing

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet Libyang

Products

Libyang Libyang

CVE-2026-115327

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2026-44673

libyang: lyb_read_string() integer overflow → heap buffer overflow

libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2023-26916

libyang: NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet Fedoraproject

Products

Libyang Fedora

CVE-2023-26917

libyang: NULL pointer dereference via lysp_stmt_validate_value at lys_parse_mem.c

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28906

libyang: NULL pointer dereference in read_yin_leaf()

In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28905

libyang: reachable assertion in lys_node_free()

In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28904

libyang: NULL pointer dereference in ext_get_plugin()

In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28903

libyang: recursive call to lyxml_parse_mem() lead to crash

A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28902

libyang: NULL pointer dereference in read_yin_container()

In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2020-5281

LDAP connector injection in Perun

In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

CVSS 3.1 · 6.2 Medium EPSS 1.4% KEV · Not listed

Vendors

Cesnet

Products

Perun

CVE-2019-20398

libyang: NULL pointer dereference in function lys_extension_instances_free()

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20397

libyang: double-free in yyparse() when organization field is not terminated

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20396

libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20395

libyang: stack-overflow when parsing yang files with self-referential union types

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20394

libyang: double-free in yyparse() when a type statement is used in a notification statement

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux