{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "CESNET libyang: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/cesnet--libyang/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/cesnet--libyang/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115327/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115327/",
   "title": "CVE-2026-115327 · CESNET libyang · disclosed",
   "content_text": "libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.",
   "date_published": "2026-10-22T10:57:45Z"
  }
 ]
}