CVE-2026-115327: libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc() in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop() to crash servers like netopeer2 or corrupt the heap.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to a NETCONF session and must be able to send RPC input to the affected server. The vulnerable parsing path is reached through NETCONF RPC action envelopes processed with lyd_parse_op().
What is the practical impact on affected NETCONF servers?
A peer can send an action element containing non-whitespace text, which can crash a server such as netopeer2 or cause heap corruption. The stated impact is availability loss; no confidentiality or integrity impact is specified.
Are all libyang uses affected?
The issue is specifically associated with parsing NETCONF RPC action envelopes in lydxml_env_netconf_rpc(). Deployments that do not accept or parse this type of NETCONF RPC input are not described as exposed by the provided information.
What can be done before updating libyang?
Restrict NETCONF session access to trusted, authorized peers and prevent untrusted peers from submitting RPC action envelopes. This reduces the ability to send the malformed action input needed to trigger the issue.