CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

• CWE-121
• CWE-121

• https://access.redhat.com/security/cve/CVE-2026-48863
• https://bugzilla.redhat.com/show_bug.cgi?id=2460975
• https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cff9e8#diff-309f245ec9b669ec78b8159c39e6f50130b4d4a0448f742685f7833d04bc4caaR592
• https://access.redhat.com/security/cve/CVE-2026-48863
• https://bugzilla.redhat.com/show_bug.cgi?id=2460975
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48863.json

Published

Jul 16, 2026

Last Modified

Jul 18, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48856Sensitive Data Exposure vulnerability in Erlang OTP inets (h…6.5
• CVE-2026-48858Server-Side Request Forgery (SSRF) vulnerability in Erlang/O…6.5
• CVE-2026-48859Observable Timing Discrepancy vulnerability in Erlang/OTP ss…5.3
• CVE-2026-48860Reliance on IP Address for Authentication vulnerability in E…6.5
• CVE-2026-48861Improper Neutralization of CRLF Sequences ('CRLF Injection')…2.1
• CVE-2026-48862Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-48864A flaw was found in libsolv. This heap buffer overflow occur…7.8
• CVE-2026-48865Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-48866Improper Limitation of a Pathname to a Restricted Directory …9.6
• CVE-2026-48867Unauthenticated Cross Site Scripting (XSS) in Quiz And Surve…7.1
• CVE-2026-48868Unauthenticated Insecure Direct Object References (IDOR) in …7.5
• CVE-2026-48869Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.…7.1