PT-2026-25869 · Libucl · Libucl

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-0708

Mitre

CVSS v3.1

8.3

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the

ucl object emit

function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-0708

Affected Products

Libucl

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-0708 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-0708 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2427770 · Note
• https://github.com/vstakhov/libucl/issues/323 · Note