Description
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1 ↗
- https://github.com/CESNET/libyang/issues/724 ↗
- https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1793924 ↗
- https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html ↗