CVE-2026-115327

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-115327
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115327.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-115327
Downstream
Related
Published
2026-10-22T10:57:45Z
Modified
2026-10-30T07:16:36Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
Details

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-824"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115327.json"
}
References

Affected packages

Git / github.com/cesnet/libyang

Affected ranges

Type
GIT
Repo
https://github.com/cesnet/libyang
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
927fce908774289a7d9c07fff5704c33965c9773
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "6.4.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "927fce908774289a7d9c07fff5704c33965c9773"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.112
v2.0.194
v2.0.231
v2.0.7
v2.0.88
v2.0.97
v2.1.111
v2.1.128
v2.1.148
v2.1.30
v2.1.4
v2.1.55
v2.1.80
v2.2.8
v3.*
v3.1.0
v3.12.2
v3.13.5
v3.13.6
v3.4.2
v3.7.8
v4.*
v4.2.2
v5.*
v5.4.9
v5.8.6
v6.*
v6.4.13

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115327.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "127219173254914505808157472323746584481",
            "length": 1480
        },
        "id": "CVE-2026-115327-327b51da",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773",
        "target": {
            "file": "src/parser_xml.c",
            "function": "lydxml_envelope"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "89304728084346618856692349022599060878",
            "length": 759
        },
        "id": "CVE-2026-115327-41198225",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773",
        "target": {
            "file": "src/parser_xml.c",
            "function": "lydxml_env_netconf_rpc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133004501468299553494451851140188856566",
            "length": 1372
        },
        "id": "CVE-2026-115327-b877e767",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773",
        "target": {
            "file": "tests/utests/data/test_parser_xml.c",
            "function": "test_netconf_action"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34402820242581308879896594684018035560",
                "290091420301790573391585413494811141342",
                "329604627931831201874904690791625665906"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-115327-e2799cc5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773",
        "target": {
            "file": "tests/utests/data/test_parser_xml.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "45077817726510003746526369560667701733",
                "89815909894730412669769800194434528947",
                "50120226179681024237482715378447211955",
                "206019831637388879909468897134896660676",
                "130895461719858185048048813565389827712",
                "187087213597855707824976147511232967815",
                "135349983010433318764970120739176184398",
                "49421772754878239733954977611393772258",
                "14332617606014411928961524990655320242",
                "220317124417081831654119108981684880074",
                "186935084167174191759726124751242915819",
                "90095811017536858794938434005905521260",
                "122217780528346330322757994972438253670",
                "41133116026508366863126198981547244852",
                "280955922252125900571918507590316326082",
                "19645497847909710288906136773093466692",
                "60468662296056258605853004236675441894",
                "116892101799624841360017640394159551675",
                "170367393310265252841774939953653189609",
                "14551811868752667407977141340990718326",
                "51875506560324174422980349184896978538",
                "218687344447093980971624364297291327840",
                "53156663697226177085758346536651476834",
                "200597402398952177489347857757514696233",
                "285104481203209980910130785464684827816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-115327-e6e5739d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773",
        "target": {
            "file": "src/parser_xml.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-30T07:16:36Z"