Executive brief
libsolv, a library used for managing software packages and repositories, contains a flaw in how it verifies digital signatures. An attacker could provide a specially crafted package or repository signature that causes the software to crash when it attempts to verify the authenticity of the data. This could lead to a denial of service, disrupting automated software updates and repository management workflows.
Technical details
A stack-based buffer overflow exists in `ext/solv_pgpvrfy.c` within the `solv_pgpvrfy()` function. The vulnerability is caused by using the incorrect length variable (`rlen` instead of `slen`) when copying the EdDSA 's' MPI into a fixed 64-byte stack buffer (`sigdata`). An attacker can trigger this by providing a crafted Ed25519 PGP signature where the 'r' MPI length is significantly larger than the 's' MPI length, leading to an out-of-bounds write of up to 31 bytes. This requires the library to be compiled with `ENABLE_PGPVRFY` and `ENABLE_PGPVRFY_ED25519`. The issue was fixed in upstream version 0.7.38.
Affected products
- OpenSUSE libsolv 0.6.4 to 0.7.37
- Red Hat Red Hat Enterprise Linux 10 libsolv-0.7.33-2.el10
Timeline
- 2026-04-23: disclosed: Reported to Red Hat Bugzilla
- 2026-05-26: patched: Fixed in upstream libsolv commit 44f8c08
- 2026-07-16: advisory: CVE published to NVD