Skip to content
Fencer Vulns
medium 6.5

CVE-2026-9150 json

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

published 2026-05-20 5 mo ago modified 2026-11-06 2 d ago also EUVD-2026-31202

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:0.7.33-5.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.7.29-8.el10_0.1
  • Red Hat Red Hat Hardened Images 0.7.38-2.hum1, 0.7.39-3.hum1
  • libsolv Debian 14 0.7.37-1

debian advisories DEBIAN-CVE-2026-9150

  • libsolv hummingbird 1 0.7.39-3.hum1
  • perl-solv hummingbird 1 0.7.39-3.hum1
  • ruby-solv hummingbird 1 0.7.39-3.hum1
  • libsolv-demo hummingbird 1 0.7.39-3.hum1
  • python3-solv hummingbird 1 0.7.39-3.hum1
  • libsolv-tools hummingbird 1 0.7.39-3.hum1
  • libsolv-tools-base hummingbird 1 0.7.39-3.hum1
  • libsolv RHEL 10.2 0.7.33-5.el10_2

red hat advisories RHSA-2026:48818RHSA-2026:30649RHSA-2026:28236RHSA-2026:21333

  • zypper SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +2 more 1.14.98-150400.3.104.1
  • libsolv SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +3 more 0.7.39-150400.3.46.1
  • libzypp SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +3 more 17.38.13-150400.3.158.1
  • libsolv SLES 15 SP6-LTSS, SLE Installer Updates 15 SP6 0.7.39-150600.8.24.1
  • libzypp SLES 15 SP6-LTSS, SLE Installer Updates 15 SP6 17.38.13-150600.3.92.1
  • zypper SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 1.14.98-150500.6.45.1
  • libsolv SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 0.7.39-150500.6.17.1
  • libzypp SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 17.38.13-150500.6.74.1

suse advisories SUSE-SU-2026:2674-1SUSE-SU-2026:2590-1SUSE-SU-2026:2575-1SUSE-SU-2026:2531-1SUSE-SU-2026:22172-1SUSE-SU-2026:22221-1

  • libsolv openSUSE Leap 16.0 0.7.39-160000.1.1
  • zypper openSUSE Leap 16.0 1.14.98-160000.1.1
  • libzypp openSUSE Leap 16.0 17.38.13-160000.1.1
  • libsolv openSUSE Tumbleweed 0.7.38-1.1

opensuse advisories openSUSE-SU-2026:21096-1openSUSE-SU-2026:10895-1

  • libsolv AlmaLinux 10 0.7.33-5.el10_2.alma.1
  • python3-solv AlmaLinux 10 0.7.33-5.el10_2.alma.1
  • libsolv-tools AlmaLinux 10 0.7.33-5.el10_2.alma.1
  • libsolv-tools-base AlmaLinux 10 0.7.33-5.el10_2.alma.1

almalinux advisories ALSA-2026:28236

  • libsolv Rocky Linux 10 0.7.33-5.el10_2

rocky linux advisories RLSA-2026:28236

  • libsolv Azure Linux 3.0 0.7.28-4

azure linux advisories AZL-88053

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9150 updated cvss 6.5

libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums

  • Red Hat Enterprise Linux 7 libsolv, libsolv-demo, python2-solv, libsolv-tools Red Hat Enterprise Linux 9 libsolv, python3-solv, libsolv-tools Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat Satellite 6 libsolv, python2-solv, python3-solv Red Hat Update Infrastructure 4 for Cloud Providers libsolv
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Enterprise Linux AppStream (v. 10) python3-solv 0.7.33-5.el10_2
    fixed: vendor fix RHSA-2026:28236
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libsolv-debuginfo 0.7.29-8.el10_0.1, libsolv-debugsource 0.7.29-8.el10_0.1
    fixed: vendor fix RHSA-2026:48818
  • Red Hat Enterprise Linux BaseOS (v. 10) libsolv 0.7.33-5.el10_2
    fixed: vendor fix RHSA-2026:28236
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libsolv 0.7.29-8.el10_0.1
    fixed: vendor fix RHSA-2026:48818
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsolv-tools 0.7.33-5.el10_2, libsolv-tools-base 0.7.33-5.el10_2
    fixed: vendor fix RHSA-2026:28236
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libsolv-debuginfo 0.7.29-8.el10_0.1, libsolv-debugsource 0.7.29-8.el10_0.1
    fixed: vendor fix RHSA-2026:48818
show 2 more
  • Red Hat Hardened Images libsolv 0.7.38-2.hum1, libsolv 0.7.39-3.hum1, perl-solv 0.7.38-2.hum1, perl-solv 0.7.39-3.hum1, ruby-solv 0.7.38-2.hum1, ruby-solv 0.7.39-3.hum1, +8 more
    fixed: vendor fix RHSA-2026:21333
  • Red Hat Enterprise Linux 8 libsolv, python3-solv, libsolv-tools Red Hat Enterprise Linux AppStream EUS (v. 10.0) python3-solv 0.7.29-8.el10_0.1 Red Hat Enterprise Linux BaseOS EUS (v. 10.0) perl-solv-debuginfo 0.7.29-8.el10_0.1, ruby-solv-debuginfo 0.7.29-8.el10_0.1, libsolv-demo-debuginfo 0.7.29-8.el10_0.1, python3-solv-debuginfo 0.7.29-8.el10_0.1, libsolv-tools-debuginfo 0.7.29-8.el10_0.1, libsolv-tools-base-debuginfo 0.7.29-8.el10_0.1 Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libsolv-tools 0.7.29-8.el10_0.1, libsolv-tools-base 0.7.29-8.el10_0.1 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Update Infrastructure 4 for Cloud Providers

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.