GNU Bison
4 CVEs affecting GNU Bison. Latest disclosed: 2026-07-29. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56389 | High | 8.6 | 2026-07-29 | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A… |
CVE-2026-56390 | Medium | 6.3 | 2026-07-29 | GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted witho… |
CVE-2020-24240 | Medium | 5.5 | 2020-08-25 | GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk onl… |
CVE-2020-14150 | Medium | 5.5 | 2020-06-15 | GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and… |