CVE-2026-61477
- Source
- https://cve.org/CVERecord?id=CVE-2026-61477
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61477.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61477
- Downstream
- Published
- 2026-08-07T14:09:23.058Z
- Modified
- 2026-08-09T08:05:11.957196Z
- Severity
-
- 2.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
- Details
-
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
- Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-93" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61477.json" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-61477
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61477.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-61477
- https://bugzilla.redhat.com/show_bug.cgi?id=2512066
- https://gitlab.com/libvirt/libvirt/-/commit/3cfc77963b512d809348fca07f97fe924fac9a05
Affected packages
Git / gitlab.com/libvirt/libvirt
Affected versions
Other
CVE-2008-5086
CVE-2010-2238
CVE-2010-2242
CVE-2011-1146
CVE-2011-1486
CVE-2011-2178
CVE-2012-3411
CVE-2012-3445
CVE-2012-4423
CVE-2013-0170
CVE-2013-1962
CVE-2013-2218
CVE-2013-2230
CVE-2013-4153
CVE-2013-4154
CVE-2013-4239
CVE-2013-4291
CVE-2013-4292
CVE-2013-4296
CVE-2013-4297
CVE-2013-4311
CVE-2013-4399
CVE-2013-4400-1
CVE-2013-4400-2
CVE-2013-4400-3
CVE-2013-4401
CVE-2013-5651
CVE-2013-6436
CVE-2013-6456
CVE-2013-6457
CVE-2013-6458-1
CVE-2013-6458-2
CVE-2013-6458-3
CVE-2013-6458-4
CVE-2013-7336
CVE-2014-0028
CVE-2014-0179
CVE-2014-1447-1
CVE-2014-1447-2
CVE-2014-3633
CVE-2014-3657
CVE-2014-7823
CVE-2014-8131
CVE-2014-8131-1
CVE-2014-8131-2
CVE-2014-8135
CVE-2014-8136
CVE-2015-0236
CVE-2015-0236-1
CVE-2015-0236-2
CVE-2015-5247-1
CVE-2015-5247-2
CVE-2015-5247-3
CVE-2015-5313
CVE-2016-5008
CVE-2017-1000256
CVE-2017-2635
CVE-2018-1064
CVE-2018-5748
CVE-2018-6764
CVE-2019-10132
CVE-2019-10161
CVE-2019-10166
CVE-2019-10167
CVE-2019-10168
CVE-2019-3886
CVE-2020-14339
CVE-2020-25637
CVE-2021-3631
CVE-2021-3667
CVE-2022-0897
CVE-2023-3750
CVE-2024-1441
CVE-2024-2494
CVE-2024-4418
CVE-2024-8235
CVE-2025-12748
CVE-2025-13193
LIBVIRT_0_0_3
LIBVIRT_0_0_4
LIBVIRT_0_0_5
LIBVIRT_0_1_0
LIBVIRT_0_1_1
LIBVIRT_0_1_10
LIBVIRT_0_1_11
LIBVIRT_0_1_3
LIBVIRT_0_1_4
LIBVIRT_0_1_6
LIBVIRT_0_1_7
LIBVIRT_0_1_8
LIBVIRT_0_1_9
LIBVIRT_0_2_0
LIBVIRT_0_2_1
LIBVIRT_0_2_2
LIBVIRT_0_3_0
LIBVIRT_0_3_1
LIBVIRT_0_3_2
LIBVIRT_0_3_3
LIBVIRT_0_4_1
LIBVIRT_0_4_2
LIBVIRT_0_4_4
LIBVIRT_0_4_6
LIBVIRT_0_5_0
LIBVIRT_0_5_1
LIBVIRT_0_6_0
LIBVIRT_0_6_1
LIBVIRT_0_6_2
LIBVIRT_0_6_3
LIBVIRT_0_6_4
LIBVIRT_0_6_5
LIBVIR_0_0_1
LIBVIR_0_0_2
LIVIRT_0_2_3
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.3
v0.1.4
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.10.0
v0.10.0-rc0
v0.10.0-rc1
v0.10.0-rc2
v0.10.1
v0.10.2
v0.10.2-rc1
v0.10.2-rc2
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.1
v0.4.2
v0.4.4
v0.4.6
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.9.0
v0.9.1
v0.9.10
v0.9.10-rc1
v0.9.10-rc2
v0.9.11
v0.9.11-rc1
v0.9.11-rc2
v0.9.12
v0.9.12-rc1
v0.9.12-rc2
v0.9.13
v0.9.13-rc1
v0.9.13-rc2
v0.9.2
v0.9.3
v0.9.3-rc1
v0.9.3-rc2
v0.9.4
v0.9.4-rc1
v0.9.4-rc2
v0.9.5
v0.9.5-rc1
v0.9.5-rc2
v0.9.5-rc3
v0.9.6
v0.9.7
v0.9.7-rc1
v0.9.8
v0.9.8-rc1
v0.9.8-rc2
v0.9.9
v0.9.9-rc1
v0.9.9-rc2
v1.*
v1.0.0
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.1
v1.0.1-rc1
v1.0.1-rc2
v1.0.2
v1.0.2-rc1
v1.0.2-rc2
v1.0.3
v1.0.3-rc1
v1.0.3-rc2
v1.0.4
v1.0.4-rc1
v1.0.4-rc2
v1.0.5
v1.0.5-rc1
v1.0.6
v1.0.6-rc1
v1.0.6-rc2
v1.1.0
v1.1.0-rc1
v1.1.0-rc2
v1.1.1
v1.1.1-rc1
v1.1.1-rc2
v1.1.2
v1.1.2-rc1
v1.1.2-rc2
v1.1.3
v1.1.3-rc1
v1.1.3-rc2
v1.1.4
v1.1.4-rc1
v1.1.4-rc2
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.2.1
v1.2.1-rc1
v1.2.1-rc2
v1.2.10
v1.2.10-rc1
v1.2.10-rc2
v1.2.11
v1.2.11-rc1
v1.2.11-rc2
v1.2.12
v1.2.12-rc1
v1.2.12-rc2
v1.2.13
v1.2.13-rc1
v1.2.13-rc2
v1.2.14
v1.2.14-rc1
v1.2.14-rc2
v1.2.15
v1.2.15-rc1
v1.2.15-rc2
v1.2.16
v1.2.16-rc1
v1.2.16-rc2
v1.2.17
v1.2.17-rc1
v1.2.17-rc2
v1.2.18
v1.2.18-rc1
v1.2.18-rc2
v1.2.19
v1.2.19-rc1
v1.2.19-rc2
v1.2.2
v1.2.2-rc1
v1.2.2-rc2
v1.2.20
v1.2.20-rc1
v1.2.20-rc2
v1.2.21
v1.2.21-rc1
v1.2.21-rc2
v1.2.3
v1.2.3-rc1
v1.2.3-rc2
v1.2.4
v1.2.4-rc1
v1.2.4-rc2
v1.2.5
v1.2.5-rc1
v1.2.5-rc2
v1.2.6
v1.2.6-rc1
v1.2.6-rc2
v1.2.7
v1.2.7-rc1
v1.2.7-rc2
v1.2.8
v1.2.8-rc1
v1.2.8-rc2
v1.2.9
v1.2.9-rc1
v1.2.9-rc2
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.3.1
v1.3.1-rc1
v1.3.1-rc2
v1.3.2
v1.3.2-rc1
v1.3.2-rc2
v1.3.3
v1.3.3-rc1
v1.3.3-rc2
v1.3.4
v1.3.4-rc1
v1.3.4-rc2
v1.3.5
v1.3.5-rc1
v10.*
v10.0.0
v10.0.0-rc1
v10.0.0-rc2
v10.1.0
v10.1.0-rc1
v10.1.0-rc2
v10.10.0
v10.10.0-rc1
v10.10.0-rc2
v10.2.0
v10.2.0-rc1
v10.2.0-rc2
v10.3.0
v10.3.0-rc1
v10.4.0
v10.4.0-rc1
v10.4.0-rc2
v10.5.0
v10.5.0-rc1
v10.5.0-rc2
v10.6.0
v10.6.0-rc1
v10.7.0
v10.7.0-rc1
v10.7.0-rc2
v10.8.0
v10.8.0-rc1
v10.8.0-rc2
v10.9.0
v10.9.0-rc1
v10.9.0-rc2
v11.*
v11.0.0
v11.0.0-rc1
v11.0.0-rc2
v11.1.0
v11.1.0-rc1
v11.1.0-rc2
v11.10.0
v11.10.0-rc1
v11.10.0-rc2
v11.2.0
v11.2.0-rc1
v11.2.0-rc2
v11.3.0
v11.3.0-rc1
v11.3.0-rc2
v11.4.0
v11.4.0-rc1
v11.4.0-rc2
v11.5.0
v11.5.0-rc1
v11.5.0-rc2
v11.6.0
v11.6.0-rc1
v11.6.0-rc2
v11.7.0
v11.7.0-rc1
v11.7.0-rc2
v11.8.0
v11.8.0-rc1
v11.8.0-rc2
v11.9.0
v11.9.0-rc1
v11.9.0-rc2
v12.*
v12.0.0
v12.0.0-rc1
v12.0.0-rc2
v12.1.0
v12.1.0-rc1
v12.1.0-rc2
v12.2.0
v12.2.0-rc1
v12.2.0-rc2
v12.3.0
v12.3.0-rc1
v12.3.0-rc2
v12.4.0
v12.4.0-rc1
v12.4.0-rc2
v12.5.0
v12.5.0-rc1
v12.5.0-rc2
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.1.0
v2.1.0-rc1
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.10.0
v3.10.0-rc1
v3.10.0-rc2
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.8.0
v3.8.0-rc1
v3.9.0
v3.9.0-rc1
v3.9.0-rc2
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.10.0
v4.10.0-rc1
v4.10.0-rc2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.5.0
v4.5.0-rc1
v4.5.0-rc2
v4.6.0
v4.6.0-rc1
v4.6.0-rc2
v4.7.0
v4.7.0-rc1
v4.7.0-rc2
v4.8.0
v4.8.0-rc1
v4.8.0-rc2
v4.9.0
v4.9.0-rc1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc2
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0
v5.10.0-rc1
v5.10.0-rc2
v5.2.0
v5.2.0-rc1
v5.2.0-rc2
v5.3.0
v5.3.0-rc1
v5.3.0-rc2
v5.4.0
v5.4.0-rc1
v5.4.0-rc2
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.6.0
v5.6.0-rc1
v5.6.0-rc2
v5.7.0
v5.7.0-rc1
v5.7.0-rc2
v5.8.0
v5.8.0-rc1
v5.8.0-rc2
v5.9.0
v5.9.0-rc1
v6.*
v6.0.0
v6.0.0-rc1
v6.0.0-rc2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.10.0
v6.10.0-rc1
v6.10.0-rc2
v6.2.0
v6.2.0-rc1
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0
v6.7.0-rc1
v6.7.0-rc2
v6.8.0
v6.8.0-rc1
v6.8.0-rc2
v6.9.0
v6.9.0-rc1
v6.9.0-rc2
v7.*
v7.0.0
v7.0.0-rc1
v7.0.0-rc2
v7.1.0
v7.1.0-rc1
v7.1.0-rc2
v7.10.0
v7.10.0-rc1
v7.10.0-rc2
v7.2.0
v7.2.0-rc1
v7.2.0-rc2
v7.3.0
v7.3.0-rc1
v7.3.0-rc2
v7.4.0
v7.4.0-rc1
v7.4.0-rc2
v7.5.0
v7.5.0-rc1
v7.5.0-rc2
v7.6.0
v7.6.0-rc1
v7.6.0-rc2
v7.7.0
v7.7.0-rc1
v7.7.0-rc2
v7.8.0
v7.8.0-rc1
v7.8.0-rc2
v7.9.0
v7.9.0-rc1
v7.9.0-rc2
v8.*
v8.0.0
v8.0.0-rc1
v8.0.0-rc2
v8.1.0
v8.1.0-rc1
v8.1.0-rc2
v8.10.0
v8.10.0-rc1
v8.10.0-rc2
v8.2.0
v8.2.0-rc1
v8.2.0-rc2
v8.3.0
v8.3.0-rc1
v8.3.0-rc2
v8.4.0
v8.4.0-rc1
v8.4.0-rc2
v8.5.0
v8.5.0-rc1
v8.5.0-rc2
v8.6.0
v8.6.0-rc1
v8.6.0-rc2
v8.7.0
v8.7.0-rc1
v8.7.0-rc2
v8.8.0
v8.8.0-rc1
v8.8.0-rc2
v8.9.0
v8.9.0-rc1
v8.9.0-rc2
v9.*
v9.0.0
v9.0.0-rc1
v9.0.0-rc2
v9.1.0
v9.1.0-rc1
v9.1.0-rc2
v9.10.0
v9.10.0-rc1
v9.10.0-rc2
v9.2.0
v9.2.0-rc1
v9.2.0-rc2
v9.3.0
v9.3.0-rc1
v9.3.0-rc2
v9.4.0
v9.4.0-rc1
v9.4.0-rc2
v9.5.0
v9.5.0-rc1
v9.5.0-rc2
v9.6.0
v9.6.0-rc1
v9.6.0-rc2
v9.7.0
v9.7.0-rc1
v9.7.0-rc2
v9.8.0
v9.8.0-rc1
v9.8.0-rc2
v9.9.0
v9.9.0-rc1
v9.9.0-rc2
Database specific
vanir_signatures_modified
"2026-08-09T08:05:11Z"
vanir_signatures
[
{
"target": {
"file": "tests/virschematest.c"
},
"digest": {
"line_hashes": [
"133954233605005987563308552535571751658",
"158925290585703084243811498830184378796",
"331176216352009358854267268860545906823",
"272133549940180185180000244465031439861",
"158217075899345673306074539861010970635",
"89292368838837576724719707065075190737"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-61477-59ff76e3",
"source": "https://gitlab.com/libvirt/libvirt@3cfc77963b512d809348fca07f97fe924fac9a05"
},
{
"target": {
"file": "tests/networkxml2xmlupdatetest.c"
},
"digest": {
"line_hashes": [
"68888094752431916243215473676037035078",
"288995729072857676923105816093189977134",
"263372141755492121532217804851606768818",
"304629448994027061454879807276276277146",
"295053441786637729800426637453647595756",
"314058758696736851029649596565116007783",
"122203876594600569836802440484042322918",
"158248643069887581582267247176081971581",
"129015924251974993683335803118554697877",
"127262528882123559083757959206626687266",
"27014478525874794620092802822762412177",
"209382760214502057303868709128332907654"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-61477-6cfd6e65",
"source": "https://gitlab.com/libvirt/libvirt@3cfc77963b512d809348fca07f97fe924fac9a05"
},
{
"target": {
"file": "tests/networkxmlconftest.c"
},
"digest": {
"line_hashes": [
"231838115855685295673848431184348645800",
"80414928417321096168291858750051984094",
"146654114811108915776984899503214448708",
"102044163281895025833985634876325822756",
"192135900847403292100438467012774094360"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-61477-8fce7865",
"source": "https://gitlab.com/libvirt/libvirt@3cfc77963b512d809348fca07f97fe924fac9a05"
},
{
"target": {
"function": "mymain",
"file": "tests/networkxmlconftest.c"
},
"digest": {
"length": 2925.0,
"function_hash": "66821359014778008981731771224155503636"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-61477-9042f4e4",
"source": "https://gitlab.com/libvirt/libvirt@3cfc77963b512d809348fca07f97fe924fac9a05"
},
{
"target": {
"function": "mymain",
"file": "tests/networkxml2xmlupdatetest.c"
},
"digest": {
"length": 7298.0,
"function_hash": "337682357011542162974494907701534235800"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-61477-a6fdf3b0",
"source": "https://gitlab.com/libvirt/libvirt@3cfc77963b512d809348fca07f97fe924fac9a05"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61477.json"