libyang - Debian Package Tracker

general

source: libyang (main)
version: 3.13.6-1
maintainer: Daniel Baumann (DMD)
arch: any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.225-1.1
stable: 3.12.2-1
stable-bpo: 3.13.6-1~bpo13+1
testing: 3.13.6-1
unstable: 3.13.6-1
exp: 6.1.4-1

versioned links

1.0.225-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.13.6-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.13.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.1.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libyang-dev
libyang3
libyang3-tools

action needed

A new upstream version is available: 5.8.6 high

A new upstream version 5.8.6 is available, you should consider packaging it.

Created: 2025-12-05 Last update: 2026-09-10 01:01

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-41401: libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
CVE-2026-44673: libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

Created: 2026-05-15 Last update: 2026-09-01 22:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-41401: libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
CVE-2026-44673: libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

Created: 2026-05-15 Last update: 2026-09-01 22:00

lintian reports 4 errors and 1 warning high

Lintian reports 4 errors and 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-11-01 Last update: 2025-11-01 17:17

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 76c80f9cf130557fe5a57256c780482a07f23ec3
Author: Daniel Baumann <daniel@debian.org>
Date:   Wed Sep 2 09:10:00 2026 +0200

    Tidying depends for debhelper 14.
    
    Signed-off-by: Daniel Baumann <daniel@debian.org>

Created: 2026-09-02 Last update: 2026-09-09 12:02

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-41401: (needs triaging) libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
CVE-2026-44673: (needs triaging) libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-05-15 Last update: 2026-09-01 22:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-libyang transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-07-31] Accepted libyang 6.1.4-1 (source) into experimental (Daniel Baumann)
[2026-07-14] Accepted libyang 5.8.6-2 (source) into experimental (Daniel Baumann)
[2026-06-23] Accepted libyang 5.8.6-1 (source) into experimental (Daniel Baumann)
[2026-06-03] Accepted libyang 5.8.5-1 (source) into experimental (Daniel Baumann)
[2026-04-29] Accepted libyang 5.7.1-1 (source) into experimental (Daniel Baumann)
[2026-04-03] Accepted libyang 5.4.9-1 (source) into experimental (Daniel Baumann)
[2026-03-30] Accepted libyang 5.4.5-1 (source) into experimental (Daniel Baumann)
[2026-03-25] Accepted libyang 5.4.1+really5.4.1-1 (source) into experimental (Daniel Baumann)
[2026-03-25] Accepted libyang 5.4.1-1 (source) into experimental (Daniel Baumann)
[2026-02-28] Accepted libyang 5.0.8-1 (source) into experimental (Daniel Baumann)
[2026-02-07] Accepted libyang 5.0.2-1 (source amd64) into experimental (Debian FTP Masters) (signed by: Daniel Baumann)
[2026-01-25] Accepted libyang 4.7.3-1 (source) into experimental (Daniel Baumann)
[2026-01-08] Accepted libyang 3.13.6-1~bpo13+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: bage@debian.org)
[2025-12-17] Accepted libyang 4.3.4-1 (source) into experimental (Daniel Baumann)
[2025-12-13] Accepted libyang 4.3.3-1 (source) into experimental (Daniel Baumann)
[2025-12-12] Accepted libyang 4.2.2-3 (source) into experimental (Daniel Baumann)
[2025-12-09] Accepted libyang 4.2.2-2 (source) into experimental (Daniel Baumann)
[2025-12-08] Accepted libyang 4.2.2-1 (source amd64) into experimental (Debian FTP Masters) (signed by: Daniel Baumann)
[2025-11-03] libyang 3.13.6-1 MIGRATED to testing (Debian testing watch)
[2025-11-01] Accepted libyang 3.13.6-1 (source) into unstable (Daniel Baumann)
[2025-08-17] libyang 3.13.5-2 MIGRATED to testing (Debian testing watch)
[2025-08-12] Accepted libyang 3.13.5-2 (source) into unstable (Daniel Baumann)
[2025-08-10] Accepted libyang 3.13.5-1 (source) into unstable (Daniel Baumann)
[2025-05-12] libyang 3.12.2-1 MIGRATED to testing (Debian testing watch)
[2025-05-02] Accepted libyang 3.12.2-1 (source) into unstable (Daniel Baumann)
[2025-03-26] libyang 3.7.8-5 MIGRATED to testing (Debian testing watch)
[2025-03-20] Accepted libyang 3.7.8-5 (source) into unstable (Daniel Baumann)
[2025-03-19] Accepted libyang 3.7.8-4 (source) into unstable (Daniel Baumann)
[2025-02-22] libyang 3.7.8-3 MIGRATED to testing (Debian testing watch)
[2025-02-16] Accepted libyang 3.7.8-3 (source) into unstable (Daniel Baumann)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (4, 1)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.13.6-1ubuntu1
patches for 3.13.6-1ubuntu1