Bison (Gnu) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 73 known versions, newest CVE from 2026-07-29. Vendor: Gnu.

CVEs of Bison

• CVE-2026-56390 - CVSS 6.3 (medium), 2026-07-29: GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted…
• CVE-2026-56389 - CVSS 8.6 (high), 2026-07-29: GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A…
• CVE-2020-24240 - CVSS 5.5 (medium), 2020-08-25: GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk…
• CVE-2020-14150 - CVSS 5.5 (medium), 2020-06-15: GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input,…