Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-48863

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenSUSE libsolv

Default version status: unaffected

  • 0.6.4 to < 0.7.38affected

Red Hat Red Hat Enterprise Linux 10

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 7

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Hardened Images

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Update Infrastructure 4 for Cloud Providers

Default version status: unaffected

References