TI-2019-14625 Aliases CVE-2019-20391 GHSA-57jg-xr2w-54jg

An invalid memory access flaw is present in libyang before v1.0-r3 in the function…

LOW 33CWE-119Published 2020-01-22 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

Why it matters now

EPSS 0.01876 79th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:cesnet:libyang:0.11:r1::::::	0.11 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.11:r2::::::	0.11 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.12:r1::::::	0.12 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.12:r2::::::	0.12 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.13:r1::::::	0.13 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.13:r2::::::	0.13 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.14:r1::::::	0.14 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.15:r1::::::	0.15 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.16:r1::::::	0.16 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.16:r2::::::	0.16 r2	Vulnerable	CESNET

cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:* Versions 0.11 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:* Versions 0.11 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:* Versions 0.12 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:* Versions 0.12 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:* Versions 0.13 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:* Versions 0.13 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:* Versions 0.14 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:* Versions 0.15 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:* Versions 0.16 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:* Versions 0.16 r2 Vulnerable ·CESNET

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:cesnet:libyang:0.16:r3::::::	0.16 r3	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:1.0:r1::::::	1.0 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:1.0:r2::::::	1.0 r2	Vulnerable	CESNET

cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:* Versions 0.16 r3 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:* Versions 1.0 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:* Versions 1.0 r2 Vulnerable ·CESNET

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	—

Timeline

2026-10-02 Threatist record created from CVE-2019-20391
2026-10-03 Alias added: GHSA-57jg-xr2w-54jg

References

Exploit 1

https://github.com/CESNET/libyang/issues/772

Patch 2

Advisory 1

https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3

Other 1

[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update

TI-2023-11820 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via… CVSS 3.1HIGH 7.5
TI-2019-13946 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
TI-2019-13945 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
TI-2019-14631 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an… CVSS 3.1HIGH 8.8
TI-2019-14628 A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type… CVSS 3.1HIGH 8.8
TI-2019-14627 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an… CVSS 3.1HIGH 8.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences