{"schema_version":"1.7.2","id":"OESA-2026-4509","modified":"2026-10-22T14:36:00Z","published":"2026-10-22T14:36:00Z","upstream":["CVE-2026-82327"],"summary":"libsolv security update","details":"A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks:\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.(CVE-2026-82327)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"libsolv","purl":"pkg:rpm/openEuler/libsolv&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22-6.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["libsolv-0.7.22-6.oe2203sp4.aarch64.rpm","libsolv-debuginfo-0.7.22-6.oe2203sp4.aarch64.rpm","libsolv-debugsource-0.7.22-6.oe2203sp4.aarch64.rpm","libsolv-demo-0.7.22-6.oe2203sp4.aarch64.rpm","libsolv-devel-0.7.22-6.oe2203sp4.aarch64.rpm","libsolv-tools-0.7.22-6.oe2203sp4.aarch64.rpm","perl-solv-0.7.22-6.oe2203sp4.aarch64.rpm","python3-solv-0.7.22-6.oe2203sp4.aarch64.rpm","ruby-solv-0.7.22-6.oe2203sp4.aarch64.rpm"],"noarch":["libsolv-help-0.7.22-6.oe2203sp4.noarch.rpm"],"src":["libsolv-0.7.22-6.oe2203sp4.src.rpm"],"x86_64":["libsolv-0.7.22-6.oe2203sp4.x86_64.rpm","libsolv-debuginfo-0.7.22-6.oe2203sp4.x86_64.rpm","libsolv-debugsource-0.7.22-6.oe2203sp4.x86_64.rpm","libsolv-demo-0.7.22-6.oe2203sp4.x86_64.rpm","libsolv-devel-0.7.22-6.oe2203sp4.x86_64.rpm","libsolv-tools-0.7.22-6.oe2203sp4.x86_64.rpm","perl-solv-0.7.22-6.oe2203sp4.x86_64.rpm","python3-solv-0.7.22-6.oe2203sp4.x86_64.rpm","ruby-solv-0.7.22-6.oe2203sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4509"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82327"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"Medium"}}