CVE catalog

CVE-2026-9150

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: May 20, 2026, 10:59:46 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 25, 2026

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libsolv	sid	`0.7.40-1`	fixed
Debian	libsolv	forky	`0.7.40-1`	fixed
Debian	libsolv	trixie	`0.7.32-1`	vulnerable
Debian	libsolv	bookworm	`0.7.23-1+deb12u1`	vulnerable
Cpe	libsolv	Not reported	Not reported	vulnerable
Cpe	libsolv	Not reported	Not reported	unknown
Cpe	hardened_images	Not reported	Not reported	unknown
Cpe	openshift_container_platform	Not reported	Not reported	unknown
Cpe	satellite	Not reported	Not reported	unknown
Cpe	update_infrastructure	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown
Cpe	libsolv	Not reported	Not reported	unknown
Cpe	hardened_images	Not reported	Not reported	unknown
Cpe	openshift_container_platform	Not reported	Not reported	unknown
Cpe	satellite	Not reported	Not reported	unknown
Cpe	update_infrastructure	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libsolv	source	sid	`0.7.37-1`	not yet assigned	Not reported	Not reported
Debian	libsolv	source	forky	`0.7.37-1`	not yet assigned	Not reported	Not reported
Debian	libsolv	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsolv	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] libsolv: Minor issue [bookworm] libsolv: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libsolv1]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolv-dev]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolv-doc]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · all · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · all · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolvext1]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolvext-dev]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolv-perl]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[libsolv-tools]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
[python3-solv]Affected
Source package: [libsolv]
Details (2)
- 0.7.23-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12
- 0.7.23-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsolv · debian · bookworm; nvd · libsolv · debian · 12

[Debian 13 (Trixie)]

[libsolv1]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolv-dev]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolv-doc]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · all · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · all · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolvext1]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolvext-dev]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolv-perl]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[libsolv-tools]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13
[python3-solv]Affected
Source package: [libsolv]
Details (2)
- 0.7.32-1 · amd64 · trixie
  Affected
  nvd · libsolv · debian · 13
- 0.7.32-1 · arm64 · trixie
  Affected
  nvd · libsolv · debian · 13

Observed: Oct 23, 2026, 10:02:50 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]