6.0
Medium
CVE-2026-115327 libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in…
Description
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libyang 6.4 | earliest → 6.4.13 | No fix stated |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- hackmd.io hackmd.io
- github.com github.com
- VulnCheck Advisory: libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser www.vulncheck.com
Timeline
- Published
- Last modified