Executive brief
A security vulnerability exists in libsolv, a library used by package managers to solve software dependencies. The flaw occurs when the library processes specially crafted Debian repository metadata containing long security checksums. If an attacker convinces a user or system to process a malicious metadata file, it can cause the application to crash, leading to a denial of service.
Technical details
A stack-based buffer overflow exists in libsolv's 'control2solvable()' function within 'ext/repo_deb.c'. The vulnerability is caused by using a fixed-size stack buffer (65 bytes) intended for 32-byte digests, while the parser accepts and validates longer SHA384 and SHA512 tags. When a 128-character SHA512 checksum is encountered, a 'strcpy' operation overflows the buffer by 64 bytes. An attacker can exploit this by providing a crafted Debian 'Packages' file. While primarily resulting in a denial of service (DoS) via memory corruption, stack corruption is present. The issue was addressed in the openSUSE/libsolv GitHub repository by enlarging the buffer and using safer memory copy operations.
Affected products
- openSUSE libsolv <= 0.7.36
Timeline
- 2026-04-21: other: Vulnerability reported to Red Hat Bugzilla
- 2026-04-22: patched: Fix merged into libsolv master branch
- 2026-05-20: disclosed: CVE published and NVD record created