CVE-2019-19334

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-19334
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19334.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-19334
Downstream
Published
2019-12-06T16:15:10Z
Modified
2026-08-07T15:18:52Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "31"
                },
                {
                    "last_affected":  "31"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / github.com/cesnet/libyang

Affected ranges

Type
GIT
Repo
https://github.com/cesnet/libyang
Events
Introduced
14a95280b2bd77b5fd1d9b5f8af71b15679f1a8f
Last Affected
64248ec90179740e66416c78e0b3b914a8a07d30
Fixed
6980afae2ff9fcd6d67508b0a3f694d75fd059d6
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r3:*:*:*:*:*:*",
        "cpe:2.3:a:cesnet:libyang:1.0:r4:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0.11-r1"
        },
        {
            "last_affected":  "0.11-r1"
        },
        {
            "introduced":  "0.11-r2"
        },
        {
            "last_affected":  "0.11-r2"
        },
        {
            "introduced":  "0.12-r1"
        },
        {
            "last_affected":  "0.12-r1"
        },
        {
            "introduced":  "0.12-r2"
        },
        {
            "last_affected":  "0.12-r2"
        },
        {
            "introduced":  "0.13-r1"
        },
        {
            "last_affected":  "0.13-r1"
        },
        {
            "introduced":  "0.13-r2"
        },
        {
            "last_affected":  "0.13-r2"
        },
        {
            "introduced":  "0.14-r1"
        },
        {
            "last_affected":  "0.14-r1"
        },
        {
            "introduced":  "0.15-r1"
        },
        {
            "last_affected":  "0.15-r1"
        },
        {
            "introduced":  "0.16-r1"
        },
        {
            "last_affected":  "0.16-r1"
        },
        {
            "introduced":  "0.16-r2"
        },
        {
            "last_affected":  "0.16-r2"
        },
        {
            "introduced":  "0.16-r3"
        },
        {
            "last_affected":  "0.16-r3"
        },
        {
            "introduced":  "1.0-r1"
        },
        {
            "last_affected":  "1.0-r1"
        },
        {
            "introduced":  "1.0-r2"
        },
        {
            "last_affected":  "1.0-r2"
        },
        {
            "introduced":  "1.0-r3"
        },
        {
            "last_affected":  "1.0-r3"
        },
        {
            "introduced":  "1.0-r4"
        },
        {
            "last_affected":  "1.0-r4"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.11-r1
0.11-r2
0.12-r1
0.12-r2
0.13-r1
0.13-r2
0.14-r1
0.15-r1
0.16-r1
0.16-r2
0.16-r3
1.*
1.0-r1
1.0-r2
1.0-r3
1.0-r4
v0.*
v0.11-r1
v0.11-r2
v0.12-r1
v0.12-r2
v0.13-r2
v0.14-r1
v0.15-r1
v0.16-r1
v0.16-r2
v1.*
v1.0-r1
v1.0-r2
v1.0-r3
v1.0-r4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19334.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292995609282841363669975935046566204682",
                "149517033522983099106477072070701937564",
                "297297297624460440254951196547675551567",
                "72996930533404138982397399557811059557",
                "274334248161745766359455477880545863750",
                "199060229445835364465972116034786537046"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-19334-0fc85d57",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/cesnet/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6",
        "target":  {
            "file":  "src/parser.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "264754062392839519042860666898880122305",
            "length":  3550
        },
        "id":  "CVE-2019-19334-8e9f3d59",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cesnet/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6",
        "target":  {
            "file":  "src/parser.c",
            "function":  "make_canonical"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T15:18:52Z"