CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern...

6.5 MediumFix available

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.93%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: CVE-2019-20396
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: CVE-2019-20396
Updated: 2026-11-02

EUVDEUVD-2019-10946 No score

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: EUVD-2019-10946
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8wpf-h467-qvv5 6.5

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern...

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: GHSA-8wpf-h467-qvv5
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-20, CWE-119
Updated: 2026-11-02

OSV 6.5

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: CVE-2019-20396
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-20396 6.5

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: DEBIAN-CVE-2019-20396
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHEA-2021:1906 7.0

Red Hat Enhancement Advisory: libyang bug fix and enhancement update

Record: RHEA-2021:1906
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-20396 6.5

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

Record: UBUNTU-CVE-2019-20396
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALEA-2021:1906 No score

libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALEA-2021:1906
Updated: 2026-11-02

Affected products

cesnet libyang

Affected packages

Affected packages
Package	Affected	Fixed
`libyang` AlmaLinux:8	before 1.0.184-1.el8	1.0.184-1.el8
`libyang` Debian:13	before 1.0.176-1	1.0.176-1
`libyang` Debian:14	before 1.0.176-1	1.0.176-1
`libyang` Debian:10	before 0.16.105+really1.0-0+deb10u1, plus listed versions 0.16.105-10.16.105-1+deb10u10.16.105-20.16.105-3	0.16.105+really1.0-0+deb10u1
`libyang` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-cpp-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`python3-libyang-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.0.184-1.el8	0:1.0.184-1.el8
`libyang` Ubuntu:20.04:LTS	All versions, plus listed versions 0.16.105-10.16.105-20.16.105-30.16.105-3build1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20396 is a medium vulnerability (CVSS 6.5) in Cesnet Libyang, published January 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in libyang 1.0.184-1.el8.

References

Show 46 moreShow less