TI-2019-14628 Aliases CVE-2019-20394 GHSA-pgmh-hmfg-8gwj

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type…

MEDIUM 43CWE-415Published 2020-01-22 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-415 and the CVSS impact.

Summary

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

Why it matters now

EPSS 0.02814 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:cesnet:libyang:0.11:r1::::::	0.11 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.11:r2::::::	0.11 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.12:r1::::::	0.12 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.12:r2::::::	0.12 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.13:r1::::::	0.13 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.13:r2::::::	0.13 r2	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.14:r1::::::	0.14 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.15:r1::::::	0.15 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.16:r1::::::	0.16 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:0.16:r2::::::	0.16 r2	Vulnerable	CESNET

cpe:2.3:a:cesnet:libyang:0.11:r1:*:*:*:*:*:* Versions 0.11 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.11:r2:*:*:*:*:*:* Versions 0.11 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.12:r1:*:*:*:*:*:* Versions 0.12 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.12:r2:*:*:*:*:*:* Versions 0.12 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.13:r1:*:*:*:*:*:* Versions 0.13 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.13:r2:*:*:*:*:*:* Versions 0.13 r2 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.14:r1:*:*:*:*:*:* Versions 0.14 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.15:r1:*:*:*:*:*:* Versions 0.15 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.16:r1:*:*:*:*:*:* Versions 0.16 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:0.16:r2:*:*:*:*:*:* Versions 0.16 r2 Vulnerable ·CESNET

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:cesnet:libyang:0.16:r3::::::	0.16 r3	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:1.0:r1::::::	1.0 r1	Vulnerable	CESNET
cpe:2.3:a:cesnet:libyang:1.0:r2::::::	1.0 r2	Vulnerable	CESNET

cpe:2.3:a:cesnet:libyang:0.16:r3:*:*:*:*:*:* Versions 0.16 r3 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:1.0:r1:*:*:*:*:*:* Versions 1.0 r1 Vulnerable ·CESNET
cpe:2.3:a:cesnet:libyang:1.0:r2:*:*:*:*:*:* Versions 1.0 r2 Vulnerable ·CESNET

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	—

Timeline

2026-10-02 Threatist record created from CVE-2019-20394
2026-10-03 Alias added: GHSA-pgmh-hmfg-8gwj

References

Exploit 1

https://github.com/CESNET/libyang/issues/769

Patch 2

Advisory 1

https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3

Other 1

[debian-lts-announce] 20230919 [SECURITY] [DLA 3572-1] libyang security update

TI-2023-11820 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via… CVSS 3.1HIGH 7.5
TI-2019-13946 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
TI-2019-13945 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
TI-2019-14631 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an… CVSS 3.1HIGH 8.8
TI-2019-14627 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an… CVSS 3.1HIGH 8.8
TI-2021-09854 A stack overflow in libyang <= v1.0.225 can cause a denial of service through function… CVSS 3.1HIGH 7.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences