CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function...

6.5 MediumFix available

CVE-2019-20392 is a medium vulnerability (CVSS 6.5) in Cesnet Libyang, published January 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in libyang 1.0.184-1.el8.

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.88%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2019-20392
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-20392
Updated: 2026-11-02

EUVDEUVD-2019-10942 No score

Record: EUVD-2019-10942
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5xx9-wg6x-hj24 6.5

An invalid memory access flaw is present in libyang before v1.0-r1 in the function...

Record: GHSA-5xx9-wg6x-hj24
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 6.5

Record: CVE-2019-20392
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-20392 6.5

Record: DEBIAN-CVE-2019-20392
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHEA-2021:1906 7.0

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Record: RHEA-2021:1906
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-20392 6.5

Record: UBUNTU-CVE-2019-20392
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALEA-2021:1906 No score

libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALEA-2021:1906
Updated: 2026-11-02

Affected products

cesnet libyang

Affected packages

Affected packages
Package	Affected	Fixed
`libyang` AlmaLinux:8	before 1.0.184-1.el8	1.0.184-1.el8
`libyang` Debian:13	before 1.0.176-1	1.0.176-1
`libyang` Debian:14	before 1.0.176-1	1.0.176-1
`libyang` Debian:10	before 0.16.105+really1.0-0+deb10u1, plus listed versions 0.16.105-10.16.105-1+deb10u10.16.105-20.16.105-3	0.16.105+really1.0-0+deb10u1
`libyang` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-cpp-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`python3-libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang` Ubuntu:20.04:LTS	All versions, plus listed versions 0.16.105-10.16.105-20.16.105-30.16.105-3build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 46 moreShow less