GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
oesa-2026-2634
Vulnerability from osv_openeuler
Published
2026-06-12 11:11
Modified
2026-08-06 11:11
Summary
libsolv security update
Details

A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks:

Security Fix(es):

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.(CVE-2026-48863)

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted .solv file containing negative size values in the repo_add_solv function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).(CVE-2026-9149)

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.(CVE-2026-9150)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libsolv-0.7.24-5.oe2403sp1.aarch64.rpm",
          "libsolv-debuginfo-0.7.24-5.oe2403sp1.aarch64.rpm",
          "libsolv-debugsource-0.7.24-5.oe2403sp1.aarch64.rpm",
          "libsolv-demo-0.7.24-5.oe2403sp1.aarch64.rpm",
          "libsolv-devel-0.7.24-5.oe2403sp1.aarch64.rpm",
          "libsolv-tools-0.7.24-5.oe2403sp1.aarch64.rpm",
          "perl-solv-0.7.24-5.oe2403sp1.aarch64.rpm",
          "python3-solv-0.7.24-5.oe2403sp1.aarch64.rpm",
          "ruby-solv-0.7.24-5.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "libsolv-help-0.7.24-5.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "libsolv-0.7.24-5.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "libsolv-0.7.24-5.oe2403sp1.x86_64.rpm",
          "libsolv-debuginfo-0.7.24-5.oe2403sp1.x86_64.rpm",
          "libsolv-debugsource-0.7.24-5.oe2403sp1.x86_64.rpm",
          "libsolv-demo-0.7.24-5.oe2403sp1.x86_64.rpm",
          "libsolv-devel-0.7.24-5.oe2403sp1.x86_64.rpm",
          "libsolv-tools-0.7.24-5.oe2403sp1.x86_64.rpm",
          "perl-solv-0.7.24-5.oe2403sp1.x86_64.rpm",
          "python3-solv-0.7.24-5.oe2403sp1.x86_64.rpm",
          "ruby-solv-0.7.24-5.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "libsolv",
        "purl": "pkg:rpm/openEuler/libsolv\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.24-5.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks:\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA \u0026apos;s\u0026apos; MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.(CVE-2026-48863)\n\nA flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).(CVE-2026-9149)\n\nA flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv\u0026apos;s Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.(CVE-2026-9150)",
  "id": "OESA-2026-2634",
  "modified": "2026-08-06T11:11:34Z",
  "published": "2026-06-12T11:11:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2634"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48863"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9149"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9150"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libsolv security update",
  "upstream": [
    "CVE-2026-48863",
    "CVE-2026-9149",
    "CVE-2026-9150"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.