This vulnerability is a stack-based buffer overflow in the libsolv library used by Red Hat Enterprise Linux 10, specifically in the Debian metadata parser component. The flaw is triggered by specially crafted Debian repository metadata containing malicious SHA384 or SHA512 checksum tags. Successful exploitation results in memory corruption that can cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to availability. Red Hat has published security advisories and released updated libsolv packages (version 0.7.38-2.hum1 and 0.7.33-5.el10_2) that fix this issue. The affected product is Red Hat Enterprise Linux 10 across multiple architectures including x86_64, aarch64, ppc64le, and s390x.

Exploitation of this vulnerability can cause memory corruption leading to a denial of service (system crash or service interruption) on affected Red Hat Enterprise Linux 10 systems. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for libsolv that address this vulnerability. Users of Red Hat Enterprise Linux 10 should apply the libsolv package updates as provided in Red Hat advisories RHSA-2026:21333 and RHSA-2026:28236. These updates fix the stack-based buffer overflow in the Debian metadata parser. Patch status is confirmed by the vendor advisories. No additional mitigation actions are required beyond applying the official updates.