CVE-2026-44942: SUSE libzypp path traversal in .repo file parsing

CVE-2026-44942 · Severity: medium · CVSS 6.5 · Published 2026-06-18

libzypp is a core library used by Linux systems (like openSUSE and SUSE Linux Enterprise) to manage software updates and repositories. A vulnerability in how it handles repository configuration files allows an attacker to trick the system into writing data to unintended locations on the hard drive. This could be used to fill up disk space in critical system directories, potentially causing the system to crash or stop functioning correctly.

Technologies: Suse Libzypp. Vendors: Suse.

Quick answers

Is CVE-2026-44942 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44942 being exploited in the wild.
How severe is CVE-2026-44942?
Medium severity, with a CVSS score of 6.5, published 18 June 2026.
Which products and versions are affected?
Suse Libzypp 17.x < 17.38.13, < 16.22.19.
Is there a fix for CVE-2026-44942?
A patch was published on 2026-06-08: Fixes identified for Code12 and Code15/16/Factory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44942 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44942?
Check whether you run Suse Libzypp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-24) exists in libzypp when processing the 'path' component of .repo files. By providing a specially crafted repository configuration file from a remote server, an attacker can inject path traversal sequences to redirect zypp cached data into arbitrary system directories. This requires the attacker to have the ability to provide or influence the repository source (low privileges required). The primary impact is on system availability, as an attacker can fill critical partitions with data. The issue is fixed in libzypp versions 17.38.13 and 16.22.19.

Affected products

  • SUSE libzypp 17.x < 17.38.13, < 16.22.19

Timeline

  • 2026-06-08: disclosed: Reported by Michael Andres to SUSE Bugzilla
  • 2026-06-08: patched: Fixes identified for Code12 and Code15/16/Factory
  • 2026-06-09: advisory: SUSE security advisories published
  • 2026-06-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.