CVE-2021-28905: 
NixOS vulnerability analysis and mitigation

CVE-2021-28905 affects libyang versions up to and including v1.0.225. The vulnerability was discovered in the lysnodefree() function where it incorrectly assumes that node->module cannot be NULL, but in certain cases, it can be null, which triggers a reachable assertion (NVD, Gentoo Advisory).

The vulnerability is classified as a reachable assertion (CWE-617) issue in the lysnodefree() function. The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network accessible, requires low attack complexity, and primarily impacts system availability (NVD).

The vulnerability can trigger a reachable assertion when node->module is NULL, which can lead to a Denial of Service condition. This affects the availability of systems using the vulnerable versions of libyang (NVD, Gentoo Advisory).

Users should upgrade to libyang version greater than 1.0.225. For Gentoo Linux users specifically, the recommendation is to upgrade to version 1.0.236 or later using the command 'emerge --ask --oneshot --verbose ">=net-libs/libyang-1.0.236"' (Gentoo Advisory).