From ad56c11278b0413bcf8399a174423f36f40f76eb Mon Sep 17 00:00:00 2001
From: AlmaLinux RelEng Bot <eabdullin@almalinux.org>
Date: Mon, 8 Jun 2026 14:31:01 -0400
Subject: [PATCH] import CS git libyang-1.0.184-2.el8_10

---
 SOURCES/libyang-fix-CVE-2026-44673.patch | 14 ++++++++++++++
 SPECS/libyang.spec                       |  9 +++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 SOURCES/libyang-fix-CVE-2026-44673.patch

diff --git a/SOURCES/libyang-fix-CVE-2026-44673.patch b/SOURCES/libyang-fix-CVE-2026-44673.patch
new file mode 100644
index 0000000..826485b
--- /dev/null
+++ b/SOURCES/libyang-fix-CVE-2026-44673.patch
@@ -0,0 +1,14 @@
+diff --git a/src/parser_lyb.c b/src/parser_lyb.c
+index 252bf77..e5bc860 100644
+--- a/src/parser_lyb.c
++++ b/src/parser_lyb.c
+@@ -160,6 +160,9 @@ lyb_read_string(const char *data, char **str, int with_length, struct lyb_state
+         }
+     }
+ 
++    LY_CHECK_ERR_RETURN(len + 1 == 0,
++      LOGERR(lybs->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL);
++
+     *str = malloc((len + 1) * sizeof **str);
+     LY_CHECK_ERR_RETURN(!*str, LOGMEM(lybs->ctx), -1);
+ 
diff --git a/SPECS/libyang.spec b/SPECS/libyang.spec
index 5c4625f..6706d8c 100644
--- a/SPECS/libyang.spec
+++ b/SPECS/libyang.spec
@@ -8,7 +8,7 @@
 
 Name: libyang
 Version: 1.0.184
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: YANG data modeling language library
 Url: https://github.com/CESNET/libyang
 Source: %{url}/archive/libyang-%{version}.tar.gz
@@ -28,6 +28,8 @@ BuildRequires:  flex
 BuildRequires:  bison
 BuildRequires:  graphviz
 
+Patch1: libyang-fix-CVE-2026-44673.patch
+
 %package devel
 Summary:    Development files for libyang
 Requires:   %{name}%{?_isa} = %{version}-%{release}
@@ -78,7 +80,6 @@ mkdir build
 %build
 cd build
 %cmake \
-   %{?_smp_mflags} \
    -DCMAKE_INSTALL_PREFIX:PATH=/usr \
    -DCMAKE_BUILD_TYPE:String="Package" \
    -DENABLE_LYD_PRIV=ON \
@@ -133,6 +134,10 @@ cp -r doc/html %{buildroot}/%{_docdir}/libyang/html
 %{python3_sitearch}/__pycache__/yang*
 
 %changelog
+* Tue Jun 02 2026 Michal Ruprich <mruprich@redhat.com> - 1.0.184-2
+- DoS or arbitrary code execution via maliciously crafted LYB binary blob
+- Resolves: RHEL-177017 - CVE-2026-44673
+
 * Thu Jan 07 2021 Michal Ruprich <mruprich@redhat.com> - 1.0.184-1
 - Resolves: #1910046 - [RFE] Rebase libyang to 1.0.184