Skip to main content

libsolv EUVDEUVD-2026-31202

| CVE-2026-9150 MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-05-20 secalert@redhat.com GHSA-p4w9-3pj8-mhq7
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Source Code Evidence Fetched
May 20, 2026 - 23:31 vuln.today
Analysis Generated
May 20, 2026 - 23:31 vuln.today

DescriptionCVE.org

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

AnalysisAI

Stack-based buffer overflow in libsolv's Debian metadata parser allows remote, unauthenticated attackers to cause a denial of service by serving maliciously crafted Debian repository metadata containing SHA384 or SHA512 checksum tags. The root cause, confirmed by the GitHub PR #616 diff, is a statically allocated 65-byte stack buffer in ext/repo_deb.c sized only for SHA256 digests, which is overflowed by the larger SHA384 (96 hex chars) and SHA512 (128 hex chars) values. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; an upstream fix is available as an open pull request.

Technical ContextAI

libsolv is an open-source dependency-solving library used by major Linux package managers, including DNF/libdnf on Fedora and RHEL and zypper on openSUSE/SUSE. The vulnerability resides in the control2solvable() function in ext/repo_deb.c, which parses Debian package control metadata. CWE-121 (Stack-Based Buffer Overflow) is triggered because the local variable char checksum[32 * 2 + 1] was allocated for exactly 65 bytes - sufficient for a SHA256 digest (32 raw bytes expressed as 64 hex characters plus a null terminator) - but the parser also processes SHA384 (48-byte digest, 96 hex chars) and SHA512 (64-byte digest, 128 hex chars) tags from repository metadata. Writing these larger values into the undersized buffer overflows the stack frame by 32 bytes for SHA384 and 64 bytes for SHA512, corrupting adjacent stack memory. The confirmed fix in PR #616 widens the buffer to char checksum[64 * 2 + 1] (129 bytes), accommodating the largest supported digest.

RemediationAI

Apply the upstream code fix from GitHub PR #616 (https://github.com/openSUSE/libsolv/pull/616), which corrects the undersized checksum buffer from char checksum[32 * 2 + 1] to char checksum[64 * 2 + 1] in ext/repo_deb.c. An officially released patched version has not been independently confirmed from available data - the fix exists only as an open pull request at time of analysis; monitor the openSUSE/libsolv releases page and the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9150 for a tagged release. As a compensating control while awaiting a packaged fix, restrict package management operations to trusted, internally mirrored repositories and block access to third-party or untrusted Debian repositories at the network or policy layer. This limits the attack surface since exploitation requires parsing attacker-controlled repository metadata, but it may disrupt workflows that depend on external Debian mirrors and should be weighed against operational needs.

CVE-2021-33938 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers

CVE-2021-33930 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows at

CVE-2021-33929 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers

CVE-2021-33928 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to ca

CVE-2018-20534 MEDIUM POC
6.5 Dec 28

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of s

CVE-2018-20533 MEDIUM POC
6.5 Dec 28

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv thr

CVE-2018-20532 MEDIUM POC
6.5 Dec 28

There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2

CVE-2026-48863 HIGH
7.5 Jul 16

Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack

CVE-2021-3200 LOW POC
3.3 May 18

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *tes

CVE-2026-9149 MEDIUM
6.5 May 21

Heap-based buffer overflow in libsolv's repo_add_solv() function enables a remote unauthenticated attacker to crash the

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

Share

EUVD-2026-31202 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy