[<prev] [day] [month] [year] [list]
Message-ID: <a2d5982ea53763b8473e9651c0b0d416@cpansec.org>
Date: Mon, 16 Mar 2026 19:34:57 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-4177: YAML::Syck versions through 1.36 for Perl has several
potential security vulnerabilities including a high-severity heap buffer
overflow in the YAML emitter
========================================================================
CVE-2026-4177 CPAN Security Group
========================================================================
CVE ID: CVE-2026-4177
Distribution: YAML-Syck
Versions: through 1.36
MetaCPAN: https://metacpan.org/dist/YAML-Syck
VCS Repo: https://github.com/cpan-authors/YAML-Syck
YAML::Syck versions through 1.36 for Perl has several potential
security vulnerabilities including a high-severity heap buffer overflow
in the YAML emitter
Description
-----------
YAML::Syck versions through 1.36 for Perl has several potential
security vulnerabilities including a high-severity heap buffer overflow
in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte
allocation.
The base64 decoder could read past the buffer end on trailing newlines.
strtok mutated n->type_id in place, corrupting shared node data.
A memory leak occurred in syck_hdlr_add_anchor when a node already had
an anchor. The incoming anchor string 'a' was leaked on early return.
Problem types
-------------
- CWE-122 Heap-based Buffer Overflow
Solutions
---------
Upgrade to version 1.37 or higher when it is available.
References
----------
https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch
https://metacpan.org/release/TODDR/YAML-Syck-1.37_01/changes#L21
Credits
-------
Todd Rinaldo, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
