libyang CVE-2026-44673

Upgrade to libyang SO 5.2.15 or later immediately, as confirmed by GitHub Security Advisory GHSA-vw2p-pq79-92xh. This vendor-released patch addresses the integer overflow in lyb_read_string() and is the primary remediation path. For environments unable to patch immediately, implement input validation to reject untrusted LYB binary data at service boundaries - restrict NETCONF servers and sysrepo instances to accept only XML/JSON YANG formats from untrusted sources, disabling LYB binary format handling where operationally feasible. This workaround trades convenience for security but carries operational overhead in high-throughput environments relying on LYB's performance characteristics. Network segmentation limiting NETCONF access to authenticated management networks reduces attack surface but does not eliminate risk from compromised administrative systems. Application-layer firewalls can inspect NETCONF traffic to filter malformed requests, though LYB binary format complexity makes effective signature-based detection challenging without deep protocol parsing. Monitor libyang-consuming services for unexpected crashes or memory corruption indicators post-patch to verify remediation effectiveness. Review https://github.com/CESNET/libyang/security/advisories/GHSA-vw2p-pq79-92xh for additional vendor guidance and affected version confirmation.