A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsolvUpgrade libsolv-toolsUpgrade libsolv-develUpgrade python3-solv | Jul 9, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libsolvUpgrade libsolv-develUpgrade libsolv-toolsUpgrade libsolv-debuginfoUpgrade python2-solvUpgrade libsolv-demo | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade libsolv-develUpgrade python3-solv-debuginfoUpgrade perl-solvUpgrade perl-solv-debuginfoUpgrade libsolv-debuginfoUpgrade python3-solvUpgrade ruby-solvUpgrade ruby-solv-debuginfoUpgrade libsolvUpgrade libsolv-demoUpgrade libsolv-toolsUpgrade libsolv-debugsourceUpgrade libsolv-tools-debuginfoUpgrade libsolv-demo-debuginfo | Jun 9, 2026 | May 26, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 27, 2026 | May 26, 2026 |
| Redhat_linux | — | Upgrade python2-solvUpgrade libsolv-toolsUpgrade libsolvUpgrade libsolv-tools-baseUpgrade perl-solv-debuginfoUpgrade ruby-solv-debuginfoUpgrade python3-solvUpgrade libsolv-tools-debuginfoUpgrade libsolv-demoUpgrade python3-solv-debuginfoUpgrade libsolv-tools-base-debuginfoUpgrade libsolv-debuginfoUpgrade libsolv-debugsourceUpgrade libsolv-develUpgrade libsolv-demo-debuginfo | Jun 25, 2026 | May 26, 2026 |
| Rocky_linux | — | Upgrade libsolv-tools-debuginfoUpgrade python3-solv-debuginfoUpgrade libsolv-debuginfoUpgrade libsolv-develUpgrade python3-solvUpgrade libsolvUpgrade libsolv-debugsourceUpgrade libsolv-tools | Jun 29, 2026 | Jun 24, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 14, 2026 | May 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub