CVE-2021-28903: Cesnet Libyang

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.

Affected products

• Cesnet Libyang: up to and including 1.0.225

Published 2021-05-20. Last modified 2026-06-17.