A flaw was found in libsolv.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 20, 2026 · NIST NVD

   Detected

   A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

2. Sep 1, 2026 · NIST NVD

   Updated

   A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

Affected

• cpe opensuse/libsolvversion unspecified
• cpe redhat/enterprise linux7.0
• cpe redhat/enterprise linux8.0
• cpe redhat/enterprise linux9.0
• cpe redhat/hardened imagesversion unspecified
• cpe redhat/openshift container platform4.0
• cpe redhat/satellite6.0
• cpe redhat/update infrastructure4

Sources

• CVE.orgVulnerability recordCVE-2026-9150

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-9150

  A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to me

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Third Party Advisory · access.redhat.com
• Issue Tracking · bugzilla.redhat.com
• Issue Tracking · github.com