PT-2023-9144 · Libyang+5 · Libyang+5

Thonsun · Published 2023-04-03 · Updated 2025-09-16 · CVE-2023-26916

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libyang versions 2.0.164 through 2.1.30

Description The issue is related to a NULL pointer dereference in the lys parse mem() function of the libyang library, which is used for YANG data modeling language parsing. This could allow a remote attacker to cause a denial of service when checking if the mod->revision value is NULL.

Recommendations For versions 2.0.164 through 2.1.30, consider disabling the lys parse mem() function as a temporary workaround until a patch is available. Restrict access to the lys parse mem.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2023-1739

AZL-25966

BDU:2024-04107

CVE-2023-26916

OPENSUSE-SU-2024:12836-1

USN-7752-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Ubuntu

Libyang

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2023-26916 · Security Note
• https://osv.dev/vulnerability/AZL-25966 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26916 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7752-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26916 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2VWGCMYKQH4BTFEHX5VYEXXOPIKKFHS · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26916 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26916 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26917 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26916 · Security Note
• https://ubuntu.com/security/CVE-2023-26916 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04107 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6NQZHCJG3SBMFOQNIPRZGKDK3ARHLTTB · Vendor Advisory
• https://osv.dev/vulnerability/USN-7752-1 · Vendor Advisory
• https://github.com/CESNET/libyang/issues/1979 · Note