DoS or arbitrary code execution via maliciously crafted LYB binary blob

RHEL-177017 - CVE-2026-44673

libyang-fix-CVE-2026-44673.patch

@@ -0,0 +1,14 @@
+diff --git a/src/parser_lyb.c b/src/parser_lyb.c
+index 252bf77..e5bc860 100644
+--- a/src/parser_lyb.c
++++ b/src/parser_lyb.c
+@@ -160,6 +160,9 @@ lyb_read_string(const char *data, char **str, int with_length, struct lyb_state
+         }
+     }
+ 
++    LY_CHECK_ERR_RETURN(len + 1 == 0,
++      LOGERR(lybs->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL);
++
+     *str = malloc((len + 1) * sizeof **str);
+     LY_CHECK_ERR_RETURN(!*str, LOGMEM(lybs->ctx), -1);
+ 

libyang.spec

@@ -8,7 +8,7 @@
 
 Name: libyang
 Version: 1.0.184
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: YANG data modeling language library
 Url: https://github.com/CESNET/libyang
 Source: %{url}/archive/libyang-%{version}.tar.gz
@@ -28,6 +28,8 @@ BuildRequires:  flex
 BuildRequires:  bison
 BuildRequires:  graphviz
 
+Patch1: libyang-fix-CVE-2026-44673.patch
+
 %package devel
 Summary:    Development files for libyang
 Requires:   %{name}%{?_isa} = %{version}-%{release}
@@ -78,7 +80,6 @@ mkdir build
 %build
 cd build
 %cmake \
-   %{?_smp_mflags} \
    -DCMAKE_INSTALL_PREFIX:PATH=/usr \
    -DCMAKE_BUILD_TYPE:String="Package" \
    -DENABLE_LYD_PRIV=ON \
@@ -133,6 +134,10 @@ cp -r doc/html %{buildroot}/%{_docdir}/libyang/html
 %{python3_sitearch}/__pycache__/yang*
 
 %changelog
+* Tue Jun 02 2026 Michal Ruprich <mruprich@redhat.com> - 1.0.184-2
+- DoS or arbitrary code execution via maliciously crafted LYB binary blob
+- Resolves: RHEL-177017 - CVE-2026-44673
+
 * Thu Jan 07 2021 Michal Ruprich <mruprich@redhat.com> - 1.0.184-1
 - Resolves: #1910046 - [RFE] Rebase libyang to 1.0.184