Live › vulnerability › CVE-2026-115327
Go to dashboardlibyang's XML parser frees an uninitialized pointer in lydxml_env_netconf_rpc() when it reads NETCONF rpc action envelopes. A peer with a NETCONF session can send an action element with non-whitespace text to crash the server, such as netopeer2, or corrupt its heap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run a NETCONF server built on libyang and accept sessions from peers, so an authenticated or reachable NETCONF client can reach the rpc action parser. Hosts that do not expose NETCONF sessions are unlikely to be exposed; the sources do not say whether NETCONF authentication is required before the parser runs.
No product ranges from the sources yet.
yanglint --version or pkg-config --modversion libyang and compare it against the affected range through 6.4.13.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
This page as .md · .json · in your agent: get_signal("CVE-2026-115327")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.