CVE-2026-0708

High

Published: 17/03/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A flaw was found in libucl that allows a remote attacker to exploit a specially crafted Universal Configuration Language (UCL) input containing a key with an embedded null byte. This can lead to a segmentation fault in the `ucl_object_emit` function, resulting in a Denial of Service (DoS) for the affected system.

Risk Assessment

An attacker could cause the system to crash, leading to service unavailability. This may impact the organization's operational continuity and reputation.

Recommendation

It is recommended to update the libucl library to the latest version to mitigate this vulnerability. Additionally, monitoring system logs for suspicious activities is advisable.

Other vulnerabilities in libucl

CVE-2025-11010Medium
A vulnerability has been found in libucl up to version 0.9.2 in the ucl_include_common function of /src/ucl_util.c. Manipulation leads to a heap-based buffer overflow. Local access is required and the exploit has been publicly disclosed.

Original NVD description (English source)

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS