DEBIAN-CVE-2026-61477

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-61477
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61477.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-61477
Upstream
Published
2026-08-07T14:17:00.187Z
Modified
2026-08-11T10:00:06.647734764Z
Severity
  • 2.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

References

Affected packages

Debian:11 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.0.0-3
7.0.0-3+deb11u1
7.0.0-3+deb11u2
7.0.0-3+deb11u3
7.0.0-3+deb11u4
7.6.0-1
7.9.0-1
7.10.0-1
7.10.0-2
7.10.0-3
8.*
8.0.0-1~bpo11+1
8.0.0-1
8.1.0-1
8.1.0-2
8.2.0-1
8.3.0-1
8.4.0-1
8.5.0-1
8.5.0-2
8.9.0-1
8.10.0-1
8.10.0-2
8.10.0-3
9.*
9.0.0-1
9.0.0-2
9.0.0-3
9.0.0-4
9.1.0-1
9.2.0-1
9.2.0-2
9.3.0-1
9.3.0-2
9.4.0-1
9.5.0-1
9.5.0-2
9.6.0-1
9.6.0-2
9.6.0-3
9.7.0-1
9.8.0-1
9.8.0-2
9.9.0-1
9.10.0-1
10.*
10.0.0-1
10.0.0-2
10.0.0-3
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.3.0-3
10.4.0-1
10.5.0-1
10.6.0-1
10.6.0-2
10.6.0-3
10.7.0-1
10.7.0-2
10.7.0-3
10.8.0-1
10.9.0-1
10.9.0-2
10.10.0-1
10.10.0-2
10.10.0-3
10.10.0-4
11.*
11.0.0-1
11.0.0-2
11.1.0-1
11.1.0-2
11.2.0-1
11.2.0-2
11.2.0-3
11.3.0-1
11.3.0-2~bpo12+1
11.3.0-2
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1
12.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61477.json"

Debian:12 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.0.0-4
9.0.0-4+deb12u1
9.0.0-4+deb12u2
9.1.0-1
9.2.0-1
9.2.0-2
9.3.0-1
9.3.0-2
9.4.0-1
9.5.0-1
9.5.0-2
9.6.0-1
9.6.0-2
9.6.0-3
9.7.0-1
9.8.0-1
9.8.0-2
9.9.0-1
9.10.0-1
10.*
10.0.0-1
10.0.0-2
10.0.0-3
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.3.0-3
10.4.0-1
10.5.0-1
10.6.0-1
10.6.0-2
10.6.0-3
10.7.0-1
10.7.0-2
10.7.0-3
10.8.0-1
10.9.0-1
10.9.0-2
10.10.0-1
10.10.0-2
10.10.0-3
10.10.0-4
11.*
11.0.0-1
11.0.0-2
11.1.0-1
11.1.0-2
11.2.0-1
11.2.0-2
11.2.0-3
11.3.0-1
11.3.0-2~bpo12+1
11.3.0-2
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1
12.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61477.json"

Debian:13 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.3.0-3
11.3.0-3+deb13u1
11.3.0-3+deb13u2
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1
12.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61477.json"

Debian:14 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.6.0-1

Affected versions

11.*
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61477.json"