Vulnerabilities > CVE-2019-20394 - Double Free vulnerability in Cesnet Libyang

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cesnet
CWE-415
NVD
Published: 2020-01-22
Updated: 2023-09-19

Summary

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

Vulnerable Configurations

Part Description Count
Application
Cesnet
13

Common Weakness Enumeration (CWE)

References