CVE-2019-20398

A NULL pointer dereference is present in libyang before v1.0-r3 in the function...

6.5 MediumFix available

CVE-2019-20398 is a medium vulnerability (CVSS 6.5) in Cesnet Libyang, published January 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in libyang 1.0.184-1.el8.

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.82%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2019-20398
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-20398
Updated: 2026-11-02

EUVDEUVD-2019-10948 No score

Record: EUVD-2019-10948
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q259-qj8c-5r52 6.5

A NULL pointer dereference is present in libyang before v1.0-r3 in the function...

Record: GHSA-q259-qj8c-5r52
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 6.5

Record: CVE-2019-20398
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-20398 6.5

Record: DEBIAN-CVE-2019-20398
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHEA-2021:1906 7.0

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Record: RHEA-2021:1906
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-20398 6.5

Record: UBUNTU-CVE-2019-20398
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALEA-2021:1906 No score

libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALEA-2021:1906
Updated: 2026-11-02

Affected products

cesnet libyang

Affected packages

Affected packages
Package	Affected	Fixed
`libyang` AlmaLinux:8	before 1.0.184-1.el8	1.0.184-1.el8
`libyang` Debian:13	before 1.0.176-1	1.0.176-1
`libyang` Debian:14	before 1.0.176-1	1.0.176-1
`libyang` Debian:10	before 0.16.105+really1.0-0+deb10u1, plus listed versions 0.16.105-10.16.105-1+deb10u10.16.105-20.16.105-3	0.16.105+really1.0-0+deb10u1
`libyang` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-cpp-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`python3-libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang` Ubuntu:20.04:LTS	All versions, plus listed versions 0.16.105-10.16.105-20.16.105-30.16.105-3build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 46 moreShow less