CVE-2026-0708: Libucl: libucl: denial of service via embedded null byte in ucl input

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-17 · updated 2026-06-17
Weakness: CWE-125

Description

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

Affected products

vstakhov libucl: through 0.9.4

References

https://access.redhat.com/security/cve/CVE-2026-0708
https://bugzilla.redhat.com/show_bug.cgi?id=2427770
https://github.com/vstakhov/libucl/issues/323
https://github.com/vstakhov/libucl/issues/323

Get alerted when CVE-2026-0708 or the next vulnerability affects your stack