PatchTheCVElibyang vulnerabilities and fixes
Recent CVEs affecting libyang, with upgrade or downgrade steps. 2 tracked.
libyang has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-04-11. Highest priority: CVE-2023-26917 (score 51/100).
- CVE-2023-26917 HIGH 7.5 UPGRADE libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_st
- CVE-2023-26916 MEDIUM 5.3 UPGRADE MITIGATE libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_par
FAQ
How do I fix libyang vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libyang being exploited right now?
None of the tracked libyang CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libyang CVE should I patch first?
CVE-2023-26917 currently ranks highest (51/100): libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_st.