CVE-2019-20396

MEDIUM

Cesnet Libyang - Memory Corruption

Title source: rule

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Core 4

Core References

Mailing List mailing-list

Patch, Third Party Advisory

Third Party Advisory

Exploit, Third Party Advisory

CVSS v3 6.5

EPSS 0.0026

EPSS Percentile 48.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-119

Status published

Products (6)

cesnet/libyang 0.11 r1 (2 CPE variants)

cesnet/libyang 0.12 r1 (2 CPE variants)

cesnet/libyang 0.13 r1 (2 CPE variants)

cesnet/libyang 0.14 r1

cesnet/libyang 0.15 r1

cesnet/libyang 0.16 r1 (3 CPE variants)

Published Jan 22, 2020

Tracked Since Feb 18, 2026