CVE-2019-19333
libyang: stack-based buffer overflow in make_canonical when bits leaf type is used
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · December 5, 2019
Updated · November 22, 2025
Description
A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or execute code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-121 · Stack-based Buffer Overflow