Libyang

Vendor:

First CVE: Dec 6, 2019 · Active for 6 years

17
Total CVEs
More Total CVEs than 93% of tracked products
4.3
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Libyang over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 6, 2019
6 years ago
Most Recent CVE
Apr 11, 2023
1,200 days ago

CVE Severity & Scoring

Libyang17 CVEs
All CVEs352,231 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network17 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low17 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None9 (52.9%)
Unknown0 (0.0%)
Required8 (47.1%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None17 (100.0%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (17 CVEs).

17 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2019-19333CRITICAL
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses lib
Dec 6, 20199.830NONO
CVE-2019-19334CRITICAL
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that u
Dec 6, 20199.829NONO
CVE-2019-20397HIGH
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input ya
Jan 22, 20208.827NONO
CVE-2019-20394HIGH
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untru
Jan 22, 20208.827NONO
CVE-2019-20393HIGH
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files ma
Jan 22, 20208.827NONO
CVE-2021-28906HIGH
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of ret
May 20, 20217.525NONO
CVE-2021-28905HIGH
In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable
May 20, 20217.525NONO
CVE-2021-28904HIGH
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].r
May 20, 20217.525NONO
CVE-2021-28903HIGH
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume
May 20, 20217.525NONO
CVE-2021-28902HIGH
In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation o
May 20, 20217.525NONO
View all 17 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (17 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (17 CVEs).

Media Mentions

Signals from CVEs in this product scope (17 CVEs).

Top CNAs Publishing CVEs For Libyang

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
1.058.73.1%00
0.16107.82.5%00
0.15107.82.5%00
0.14107.82.5%00
0.13107.82.5%00
0.12107.82.5%00
0.11107.82.5%00