AZL-110492: CVE-2026-115327 affecting package libyang 2.1.148-3

Q: Which systems are realistically exposed?

Servers that use libyang to parse NETCONF RPC action envelopes are exposed. The data specifically identifies servers such as netopeer2.

Q: What access does an attacker need to trigger the issue?

The attacker needs to be a peer with an established NETCONF session. They can submit an action element containing non-whitespace text through lyd_parse_op().

Q: What is the likely result of successful exploitation?

A crafted request can crash the affected server or corrupt its heap. The issue is an uninitialized pointer free in lydxml_env_netconf_rpc().

Published Oct 22, 2026

Updated

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc() in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop() to crash servers like netopeer2 or corrupt the heap.

Affected Software

1 affected component

azure-linux/libyang<=2.1.148-3

Event History

Oct 22, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115327

Frequently Asked Questions

Which systems are realistically exposed?

Servers that use libyang to parse NETCONF RPC action envelopes are exposed. The data specifically identifies servers such as netopeer2.

What access does an attacker need to trigger the issue?

The attacker needs to be a peer with an established NETCONF session. They can submit an action element containing non-whitespace text through lyd_parse_op().

What is the likely result of successful exploitation?

A crafted request can crash the affected server or corrupt its heap. The issue is an uninitialized pointer free in lydxml_env_netconf_rpc().

AZL-110492: CVE-2026-115327 affecting package libyang 2.1.148-3

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are realistically exposed?

What access does an attacker need to trigger the issue?

What is the likely result of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed?

What access does an attacker need to trigger the issue?

What is the likely result of successful exploitation?