cesnet vulnerabilities

Products

• libyang 19
• ipfixcol2 3
• cesnet/simplesamlphp-module-proxystatistics 1
• netopeer2 1
• perun 1
• proxystatistics 1
• theme-cesnet 1

Latest cesnet CVEs

Newest publication first · page 1 of 2

1. CVE-2026-122130 CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin

   Published 2026-11-04

   High·CVSS 8.3 EPSS 0.32%

   CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large...

2. CVE-2026-122129 CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder

   Published 2026-11-04

   Medium·CVSS 6.9 EPSS 0.40%

   CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with ve...

3. CVE-2026-122127 CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder

   Published 2026-11-04

   High·CVSS 8.7 EPSS 0.39%

   CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled b...

4. CVE-2026-63201 netopeer2-server logging has format string vulnerability via subtree filter

   Published 2026-10-30

   High·CVSS 7.1 EPSS 0.43%

   Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains for...

5. CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

   Published 2026-10-22

   Medium·CVSS 6.0 EPSS 0.31%

   libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to cras...

6. CVE-2026-44673 libyang: lyb_read_string() integer overflow → heap buffer overflow

   Published 2026-05-14

   High·CVSS 7.5 EPSS 0.64%

   libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang c...

7. CVE-2023-26917 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

   Published 2023-04-11

   High·CVSS 7.5 EPSS 0.89%

   libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

8. CVE-2023-26916 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.

   Published 2023-04-03

   Medium·CVSS 5.3 EPSS 0.99%

   libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.

9. CVE-2016-15014 CESNET theme-cesnet resetpassword.php insufficiently protected credentials

   Published 2023-01-07

   Medium·CVSS 5.5 EPSS 0.24%

   A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functionality of the file cesnet/core/lostpassword/templates/resetpassword.php. The manipulation leads to insufficiently protect...

10. CVE-2021-28906 In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags t...

    Published 2021-05-20

    High·CVSS 7.5 EPSS 1.6%

    In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

11. CVE-2021-28905 In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617)...

    Published 2021-05-20

    High·CVSS 7.5 EPSS 1.4%

    In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).

12. CVE-2021-28904 In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead t...

    Published 2021-05-20

    High·CVSS 7.5 EPSS 1.4%

    In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.

13. CVE-2021-28903 A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lea...

    Published 2021-05-20

    High·CVSS 7.5 EPSS 2.4%

    A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.

14. CVE-2021-28902 In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->fl...

    Published 2021-05-20

    High·CVSS 7.5 EPSS 1.6%

    In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.

15. CVE-2020-5281 LDAP connector injection in Perun

    Published 2020-03-25

    High·CVSS 7.5 EPSS 1.4%

    In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

16. CVE-2019-20398 A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang....

    Published 2020-01-22

    Medium·CVSS 6.5 EPSS 1.8%

    A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

17. CVE-2019-20397 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vuln...

    Published 2020-01-22

    High·CVSS 8.8 EPSS 2.5%

    A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

18. CVE-2019-20396 A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

    Published 2020-01-22

    Medium·CVSS 6.5 EPSS 1.9%

    A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

19. CVE-2019-20395 A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

    Published 2020-01-22

    Medium·CVSS 6.5 EPSS 1.9%

    A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

20. CVE-2019-20394 A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang file...

    Published 2020-01-22

    High·CVSS 8.8 EPSS 2.8%

    A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code...

21. CVE-2019-20393 A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to t...

    Published 2020-01-22

    High·CVSS 8.8 EPSS 2.8%

    A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

22. CVE-2019-20392 An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defi...

    Published 2020-01-22

    Medium·CVSS 6.5 EPSS 1.9%

    An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

23. CVE-2019-20391 An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse unt...

    Published 2020-01-22

    Medium·CVSS 6.5 EPSS 1.9%

    An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

24. CVE-2019-19334 In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse...

    Published 2019-12-06

    Critical·CVSS 9.8 EPSS 3.9%

    In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attac...

25. CVE-2019-19333 In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrus...

    Published 2019-12-06

    Critical·CVSS 9.8 EPSS 3.6%

    In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.