Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 16, 2026

Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.

Affected VersionsENISA

libsolv 0.6.4 <0.7.38

Affected Packages

euvd libsolv fix: 0.7.38

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libsolv gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 16, 2026 - 02:02 EUVD
CVE Published
Jul 16, 2026 - 00:46 cve.org
HIGH 7.5

DescriptionCVE.org

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in libsolv threatens the automated package management infrastructure across major Linux and container platforms including Red Hat Enterprise Linux, Ubuntu, Debian, and OpenShift. Malicious actors can remotely crash package processing systems, potentially disrupting critical software updates and supply chain operations for organizations running these environments. The risk is elevated for organizations with large-scale automated patching or container orchestration deployments.

Recommended Action

Within 24 hours, identify all systems running affected libsolv versions across RHEL 7/8/9/10, Ubuntu, Debian, openSUSE/SUSE, OpenShift, Satellite, or RHUI deployments and assess exposure scope. Within 7 days, implement network segmentation to isolate package repository processing infrastructure from untrusted external sources and configure monitoring and alerting for crashes in package processing pipelines. Within 30 days, establish regular contact with vendors (Red Hat, Canonical, Debian, SUSE) for patching timelines and prepare patch testing procedures; evaluate temporary mitigations such as restricting or disabling Ed25519 signature verification if operationally feasible, and consider failover to cached or alternative package repositories during high-risk periods.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation restricting package repository access to trusted internal sources only; additional monitoring and alerting on package manager crashes and solv_pgpvrfy errors; temporary restriction or disabling of Ed25519 signature verification in isolated environments; failover strategies using cached package repositories; and coordination with infrastructure teams to implement access controls on systems performing automated package processing.

Threat Intelligence Overview

EPSS Score
0.8%
Top 48% exploitable
Vendor Action
See Below
Not affected (vendor confirmed)
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.8%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libsolv

View all
CVE-2021-33938 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers
CVE-2021-33930 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows at
CVE-2021-33929 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers
CVE-2021-33928 HIGH POC
7.5 Sep 02

Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to ca
CVE-2018-20534 MEDIUM POC
6.5 Dec 28

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of s
CVE-2018-20533 MEDIUM POC
6.5 Dec 28

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv thr
CVE-2018-20532 MEDIUM POC
6.5 Dec 28

There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2

CVE-2021-3200 LOW POC
3.3 May 18

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *tes
CVE-2026-9149 MEDIUM
6.5 May 21

Heap-based buffer overflow in libsolv's repo_add_solv() function enables a remote unauthenticated attacker to crash the

CVE-2026-9150 MEDIUM
6.5 May 20

Stack-based buffer overflow in libsolv's Debian metadata parser allows remote, unauthenticated attackers to cause a deni

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
libsolv
Release Status Version
questing ignored end of life, was needs-triage
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
resolute needs-triage -
upstream released 0.7.38-1

Debian

libsolv
Release Status Fixed Version Urgency
bullseye vulnerable 0.7.17-1+deb11u1 -
bookworm vulnerable 0.7.23-1+deb12u1 -
trixie vulnerable 0.7.32-1 -
forky, sid fixed 0.7.39-1 -
(unstable) fixed 0.7.38-1 -

SUSE

Severity: Important
Product Status
Container suse/ltss/sle15.4/sle15:15.4-6.29 Container suse/manager/4.3/proxy-httpd:4.3.18.9.79.16 Container suse/manager/4.3/proxy-salt-broker:4.3.18.9.69.16 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.138 Container suse/sle-micro/5.3/toolbox:16.3-6.11.242 Container suse/sle-micro/5.4/toolbox:16.3-5.19.243 Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Container suse/ltss/sle15.5/sle15:15.5-8.46 Container suse/sle-micro/5.5/toolbox:16.3-3.12.150 Container suse/sle-micro/base-5.5:2.0.4-5.8.285 Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/ltss/sle15.6/sle15:15.6-5.66 Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.4.8.24.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.4.9.22.2 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.4.9.22.1 Container suse/sle15:15.7-5.20.31 Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Image proxy-salt-broker-image Image server-saline-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.4.8.22.1 Image server-image-sles15sp7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48863 ADVISORY https://vuldb.com/vuln/366908 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21988/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21992/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22172/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22221/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2531/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2575/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2590/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2674/ REF https://access.redhat.com/security/cve/CVE-2026-48863 REF https://bugzilla.redhat.com/show_bug.cgi?id=2460975 REF https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cff9e8#diff-309f245ec9b669ec78b8159c39e6f50130b4d4a0448f742685f7833d04bc4caaR592 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48863.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy