{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41401.json"
      }
    ],
    "title": "libyang: libyang: Potential code execution via crafted YANG XML documents",
    "tracking": {
      "current_release_date": "2026-08-17T16:13:14+00:00",
      "generator": {
        "date": "2026-08-17T16:13:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "CVE-2026-41401",
      "initial_release_date": "2026-05-26T14:08:48.973000+00:00",
      "revision_history": [
        {
          "date": "2026-05-26T14:08:48.973000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-11T09:28:19+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-17T16:13:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 10",
                "product": {
                  "name": "Red Hat Enterprise Linux 10",
                  "product_id": "red_hat_enterprise_linux_10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 10"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 8",
                "product": {
                  "name": "Red Hat Enterprise Linux 8",
                  "product_id": "red_hat_enterprise_linux_8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 8"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "red_hat_enterprise_linux_9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 9"
          },
          {
            "category": "product_version",
            "name": "libyang-devel",
            "product": {
              "name": "libyang-devel",
              "product_id": "libyang-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libyang-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libyang-devel-doc",
            "product": {
              "name": "libyang-devel-doc",
              "product_id": "libyang-devel-doc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libyang-devel-doc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libyang",
            "product": {
              "name": "libyang",
              "product_id": "libyang",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libyang"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libyang.src",
            "product": {
              "name": "libyang.src",
              "product_id": "libyang.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libyang?arch=src"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:libyang"
        },
        "product_reference": "libyang",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-devel as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:libyang-devel"
        },
        "product_reference": "libyang-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-devel-doc as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:libyang-devel-doc"
        },
        "product_reference": "libyang-devel-doc",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang.src as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:libyang.src"
        },
        "product_reference": "libyang.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:libyang"
        },
        "product_reference": "libyang",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang.src as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:libyang.src"
        },
        "product_reference": "libyang.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:libyang"
        },
        "product_reference": "libyang",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-devel as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:libyang-devel"
        },
        "product_reference": "libyang-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang-devel-doc as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:libyang-devel-doc"
        },
        "product_reference": "libyang-devel-doc",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libyang.src as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:libyang.src"
        },
        "product_reference": "libyang.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41401",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-05-26T15:01:47.851380+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481478"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libyang. This heap use-after-free write vulnerability, specifically within the lyd_parser_set_data_flags function, occurs when the software incorrectly updates metadata list pointers during the freeing of non-head default metadata entries. A remote attacker can exploit this by submitting specially crafted YANG XML documents containing specific metadata attributes to applications that parse untrusted XML data. Successful exploitation could lead to application process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libyang: libyang: Potential code execution via crafted YANG XML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability affects applications using libyang to process XML-encoded YANG data. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nAn authenticated attacker may supply specially crafted YANG/XML input that triggers a heap use-after-free condition during metadata parsing operations, resulting in application crashes and denial of service.\n\nAlthough the vulnerability involves heap memory corruption, the current analysis and reproductions demonstrate denial-of-service impact through application crashes rather than reliable arbitrary code execution. Red Hat therefore assessed the impact as limited to Availability (A:H).\n\nBecause exploitation generally requires the ability to submit or process crafted YANG configuration data, Red Hat assessed Privileges Required as Low (PR:L).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_enterprise_linux_10:libyang",
          "red_hat_enterprise_linux_10:libyang-devel",
          "red_hat_enterprise_linux_10:libyang-devel-doc",
          "red_hat_enterprise_linux_10:libyang.src",
          "red_hat_enterprise_linux_8:libyang",
          "red_hat_enterprise_linux_8:libyang.src",
          "red_hat_enterprise_linux_9:libyang",
          "red_hat_enterprise_linux_9:libyang-devel",
          "red_hat_enterprise_linux_9:libyang-devel-doc",
          "red_hat_enterprise_linux_9:libyang.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41401"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481478",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481478"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41401"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41401",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41401"
        },
        {
          "category": "external",
          "summary": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c",
          "url": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c"
        },
        {
          "category": "external",
          "summary": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc",
          "url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc"
        },
        {
          "category": "external",
          "summary": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E",
          "url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing",
          "url": "https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing"
        }
      ],
      "release_date": "2026-05-26T14:08:48.973000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "red_hat_enterprise_linux_10:libyang",
            "red_hat_enterprise_linux_10:libyang-devel",
            "red_hat_enterprise_linux_10:libyang-devel-doc",
            "red_hat_enterprise_linux_10:libyang.src",
            "red_hat_enterprise_linux_8:libyang",
            "red_hat_enterprise_linux_8:libyang.src",
            "red_hat_enterprise_linux_9:libyang",
            "red_hat_enterprise_linux_9:libyang-devel",
            "red_hat_enterprise_linux_9:libyang-devel-doc",
            "red_hat_enterprise_linux_9:libyang.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Fix deferred",
          "product_ids": [
            "red_hat_enterprise_linux_10:libyang",
            "red_hat_enterprise_linux_10:libyang-devel",
            "red_hat_enterprise_linux_10:libyang-devel-doc",
            "red_hat_enterprise_linux_10:libyang.src",
            "red_hat_enterprise_linux_8:libyang",
            "red_hat_enterprise_linux_8:libyang.src",
            "red_hat_enterprise_linux_9:libyang",
            "red_hat_enterprise_linux_9:libyang-devel",
            "red_hat_enterprise_linux_9:libyang-devel-doc",
            "red_hat_enterprise_linux_9:libyang.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "red_hat_enterprise_linux_10:libyang",
            "red_hat_enterprise_linux_10:libyang-devel",
            "red_hat_enterprise_linux_10:libyang-devel-doc",
            "red_hat_enterprise_linux_10:libyang.src",
            "red_hat_enterprise_linux_8:libyang",
            "red_hat_enterprise_linux_8:libyang.src",
            "red_hat_enterprise_linux_9:libyang",
            "red_hat_enterprise_linux_9:libyang-devel",
            "red_hat_enterprise_linux_9:libyang-devel-doc",
            "red_hat_enterprise_linux_9:libyang.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "red_hat_enterprise_linux_10:libyang",
            "red_hat_enterprise_linux_10:libyang-devel",
            "red_hat_enterprise_linux_10:libyang-devel-doc",
            "red_hat_enterprise_linux_10:libyang.src",
            "red_hat_enterprise_linux_8:libyang",
            "red_hat_enterprise_linux_8:libyang.src",
            "red_hat_enterprise_linux_9:libyang",
            "red_hat_enterprise_linux_9:libyang-devel",
            "red_hat_enterprise_linux_9:libyang-devel-doc",
            "red_hat_enterprise_linux_9:libyang.src"
          ]
        }
      ],
      "title": "libyang: libyang: Potential code execution via crafted YANG XML documents"
    }
  ]
}