CVE-2026-0708

MEDIUM 6.5CVE-2026-0708 · Published 17/03/2026 · updated 17/06/2026

In short

CVE-2026-0708 is a MEDIUM (CVSS 6.5) vulnerability affecting libucl (vstakhov).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libucl vstakhov	`≤ 0.9.4`	No fix yet

Description

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

References

access.redhat.com/security/cve/CVE-2026-0708 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
vstakhov/libucl · Exploit

More vulnerabilities in libucl

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free