Every CVE Search/ Get API key

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function...

6.5 MediumFix available

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.88%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
CVE-2019-20391
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
CVE-2019-20391
Updated
2026-11-02
EUVDEUVD-2019-10941 No score

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
EUVD-2019-10941
Updated
2026-11-03
GitHub AdvisoriesGHSA-57jg-xr2w-54jg 6.5

An invalid memory access flaw is present in libyang before v1.0-r3 in the function...

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
GHSA-57jg-xr2w-54jg
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 6.5

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
CVE-2019-20391
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-20391 6.5

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
DEBIAN-CVE-2019-20391
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHEA-2021:1906 7.0

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Record
RHEA-2021:1906
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-20391 6.5

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Record
UBUNTU-CVE-2019-20391
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALEA-2021:1906 No score

libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALEA-2021:1906
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libyang
AlmaLinux:8
 before 1.0.184-1.el8
1.0.184-1.el8
libyang
Debian:13
 before 1.0.176-1
1.0.176-1
libyang
Debian:14
 before 1.0.176-1
1.0.176-1
libyang
Debian:10
 before 0.16.105+really1.0-0+deb10u1, plus listed versions
0.16.105-10.16.105-1+deb10u10.16.105-20.16.105-3
0.16.105+really1.0-0+deb10u1
libyang
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.184-1.el8
0:1.0.184-1.el8
libyang-cpp-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.184-1.el8
0:1.0.184-1.el8
libyang-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.184-1.el8
0:1.0.184-1.el8
libyang-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.184-1.el8
0:1.0.184-1.el8
python3-libyang-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.184-1.el8
0:1.0.184-1.el8
libyang
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.16.105-10.16.105-20.16.105-30.16.105-3build1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20391 is a medium vulnerability (CVSS 6.5) in Cesnet Libyang, published January 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in libyang 1.0.184-1.el8.

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open