CVE-2026-9150
Last modified
CVE-2026-9150 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Libsolv | <= 0.7.36 |
| Redhat | Hardened Images | All versions |
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Satellite | 6.0 |
| Redhat | Update Infrastructure | 4 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux | 9.0 |
| Redhat | Enterprise Linux | 10.0 |
References
- https://access.redhat.com/security/cve/CVE-2026-9150Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2460379Issue Tracking, Third Party Advisory
- https://github.com/openSUSE/libsolv/pull/616Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-9150?
How severe is CVE-2026-9150?
How do I fix CVE-2026-9150?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9143There is an incorrect conversion between numeric types vulne…5.3
- CVE-2026-9144Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…8.4
- CVE-2026-9145The Database for Contact Form 7, WPforms, Elementor forms pl…6.5
- CVE-2026-9147uproot dynamically generates Python class source code from R…8.5
- CVE-2026-9148The Comments – wpDiscuz plugin for WordPress is vulnerable t…7.2
- CVE-2026-9149A flaw was found in libsolv. This heap buffer overflow vulne…6.5
- CVE-2026-9151An OS command injection vulnerability exists in the VPN modu…8.5
- CVE-2026-9152A missing authentication vulnerability exists in the Altium …10
- CVE-2026-9153Arbitrary File Read vulnerability in Rapid7 InsightConnect S…6.5
- CVE-2026-9154Arbitrary File Write vulnerability in Rapid7 InsightConnect …6.5
- CVE-2026-9155OS Command Injection vulnerability in Rapid7 InsightConnect …8.8
- CVE-2026-9156Tanium addressed a denial of service vulnerability in Tanium…7.5
Are you affected by CVE-2026-9150?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST