CVE-2026-9149

Full vulnerability record from the local CVENow database.
Description

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
Severity
MEDIUM
CVSS score
6.5 (v3.1)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2026-05-21 00:16:35.630000
Last modified
2026-11-06 02:18:00.570000
View original CVE JSON
{
  "id": "CVE-2026-9149",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-21T00:16:35.630",
  "lastModified": "2026-11-06T02:18:00.570",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS)."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo en libsolv. Esta vulnerabilidad de desbordamiento de búfer de pila ocurre cuando una víctima procesa un archivo '.solv' especialmente diseñado que contiene valores de tamaño negativos en la función 'repo_add_solv'. Esto lleva a una asignación de memoria de tamaño insuficiente y a una escritura fuera de límites posterior. Un atacante podría explotar esto para causar una denegación de servicio (DoS)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "versions": [
            {
              "version": "0:0.7.33-5.el10_2",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "versions": [
            {
              "version": "0:0.7.29-8.el10_0.1",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "libsolv-main",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "versions": [
            {
              "version": "0.7.38-2.hum1",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift/ose-rhel-coreos-8",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift/ose-rhel-coreos-9",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Satellite 6",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "satellite-capsule:el8/libsolv",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsolv",
          "cpes": [
            "cpe:/a:redhat:rhui:4::el8"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-21T12:22:28.191967Z",
          "id": "CVE-2026-9149",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opensuse:libsolv:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "0.7.36",
              "matchCriteriaId": "C5E77B8B-49EC-4357-9246-3B07632AFF19"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "87DEB507-5B64-47D7-9A50-3B87FD1E571F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "848C92A9-0677-442B-8D52-A448F2019903"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:update_infrastructure:4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D92E10-0E79-479F-A963-5657D1BC4E03"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:21333",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:28236",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:48818",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-9149",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460380",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/openSUSE/libsolv/pull/617",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openSUSE/libsolv/pull/617",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}