CVE-2026-41401

libyang - Heap Use-After-Free Write in XML Metadata Parsing

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet Libyang

Products

Libyang Libyang

CVE-2026-115327

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2026-44673

libyang: lyb_read_string() integer overflow → heap buffer overflow

libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2023-26916

libyang: NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cesnet Fedoraproject

Products

Libyang Fedora

CVE-2023-26917

libyang: NULL pointer dereference via lysp_stmt_validate_value at lys_parse_mem.c

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28906

libyang: NULL pointer dereference in read_yin_leaf()

In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28905

libyang: reachable assertion in lys_node_free()

In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28904

libyang: NULL pointer dereference in ext_get_plugin()

In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28903

libyang: recursive call to lyxml_parse_mem() lead to crash

A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2021-28902

libyang: NULL pointer dereference in read_yin_container()

In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Cesnet

Products

Libyang

CVE-2019-20398

libyang: NULL pointer dereference in function lys_extension_instances_free()

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20397

libyang: double-free in yyparse() when organization field is not terminated

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20396

libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20395

libyang: stack-overflow when parsing yang files with self-referential union types

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20394

libyang: double-free in yyparse() when a type statement is used in a notification statement

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20393

libyang: double-free in function yyparse() when empty description is used

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20392

libyang: invalid memory access when if-feature statement is used inside a list key node

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20391

libyang: invalid memory access in resolve_feature_value() when a if-feature is used inside a bit

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-19334

libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed

Vendors

Cesnet Fedoraproject Redhat

Products

Libyang Fedora Enterprise Linux

CVE-2019-19333

libyang: stack-based buffer overflow in make_canonical when bits leaf type is used

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux