Cesnet maintains a specialized portfolio of research networking and identity-management software that, despite modest volume, occupies a prominent position within academic and research infrastructure ecosystems. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and recur across a narrow set of foundational products including the libyang data-modeling library, the Perun identity and access management platform, and associated administrative and reporting tools. The exposure concentrates in memory-safety and input-validation weakness classes—double-free conditions, buffer-boundary violations, NULL-pointer dereferences, and unchecked return values—that are characteristic of C-based infrastructure software handling complex data structures and network protocols. Defenders operating research networks and institutions using these products should prioritize inventory and patching, particularly for libyang given its role as a dependency in network-configuration tooling; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cesnet over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-19333CRITICAL In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses lib | Dec 6, 2019 | 9.8 | 30 | NO | NO |
CVE-2019-15537CRITICAL The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. | Aug 23, 2019 | 9.8 | 30 | NO | NO |
CVE-2019-19334CRITICAL In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that u | Dec 6, 2019 | 9.8 | 29 | NO | NO |
CVE-2019-20397HIGH A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input ya | Jan 22, 2020 | 8.8 | 27 | NO | NO |
CVE-2019-20394HIGH A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untru | Jan 22, 2020 | 8.8 | 27 | NO | NO |
CVE-2019-20393HIGH A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files ma | Jan 22, 2020 | 8.8 | 27 | NO | NO |
CVE-2021-28906HIGH In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of ret | May 20, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-28905HIGH In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable | May 20, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-28904HIGH In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].r | May 20, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-28903HIGH A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume | May 20, 2021 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cesnet.
Media articles that mention a CVE ID that affects a product developed by Cesnet — matched by CVE ID, not by vendor name.