Libsolv contains a stack‑based buffer overflow in its Debian metadata parser when processing SHA384 or SHA512 checksum tags. The flaw can lead to memory corruption that may crash the process, resulting in a denial of service. The weakness is a classic stack overflow (CWE‑121) affecting the handling of repository metadata.

The vulnerability impacts all Red Hat distributions that incorporate libsolv, including Red Hat Enterprise Linux 10, 7, 8, 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 for Cloud Providers. Any system that consumes Debian repository metadata using libsolv is affected, with no specific product version constraints given in the advisory.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not currently listed in CISA’s KEV catalog, nor is there an EPSS score available. Attackers likely need to control or influence a Debian repository fed to the vulnerable system; by delivering a specially crafted Packages file containing malicious SHA384/512 checksums, they can trigger the overflow and crash the parser, leading to a denial of service. No exploit code is disclosed, but the path to crash is clear if the attacker can supply the metadata.