YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document

A flaw was found in YAML::Syck. This vulnerability allows a remote attacker to cause a denial of service DoS by providing a specially crafted YAML document. The flaw occurs due to a use-after-free and double-free condition when an anchor node is redefined while still on the parser's value stack,...

Important: Red Hat Security Advisory: perl-YAML-Syck security update

An update for perl-YAML-Syck is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: perl-YAML-Syck security update

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. Security Fixes: YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document CVE-2026-13713...

AlmaLinux 8 : perl-YAML-Syck (ALSA-2026:67269)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:67269 advisory. YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document CVE-2026-13713 Tenable has extracted the preceding description block directly from the AlmaLinu...

MGASA-2026-0367 Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored unde...

Amazon Linux 2023 : perl-YAML-Syck, perl-YAML-Syck-tests (ALAS2023-2026-2007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2007 advisory. YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored unde...

Amazon Linux 2 : perl-YAML-Syck, --advisory ALAS2-2026-3837 (ALAS-2026-3837)

The version of perl-YAML-Syck installed on the remote host is prior to 1.27-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3837 advisory. YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still...

Security update for perl-YAML-Syck (important)

openSUSE Security Update: Security update for perl-YAML-Syck Announcement ID: openSUSE-SU-2026:0273-1 Rating: important References: 1265155 1271631 1271632 1271633 1271634 Cross-References: CVE-2025-11683 CVE-2026-13713 CVE-2026-5089 CVE-2026-57075 CVE-2026-57076 CVE-2026-57077 CVSS scores:...

openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:21497-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21497-1 advisory. Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load...

OPENSUSE-SU-2026:21452-1 Security update for perl-YAML-Syck

This update for perl-YAML-Syck fixes the following issues: Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags reported by Paul Johnson via CPANSec, PR 213: -...

[SECURITY] Fedora 44 Update: perl-YAML-Syck-1.47-1.fc44

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around...

Fedora 44 : perl-YAML-Syck (2026-2139aa7dce)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2139aa7dce advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...

Fedora 43 : perl-YAML-Syck (2026-c8484f1afb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8484f1afb advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...

SUSE CVE-2026-57075

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte = 0x80 sign-extends to a negative index and...

SUSE CVE-2026-57076

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor. In the bundled libsyck an anchor name allocated by syckstrndup is stored both as node-anchor, freed when the node is freed, and as the key in the parser's...

CVE-2026-57076

A flaw was found in YAML::Syck. An attacker could exploit a heap use-after-free vulnerability by providing a specially crafted YAML document that reuses an anchor name as an anchors-table key. This flaw causes the software to read freed heap memory, which may lead to information disclosure or...

CVE-2026-57077

A flaw was found in YAML::Syck. An out-of-bounds read vulnerability exists due to an unbounded newline scan during block-scalar lexing. A remote attacker could exploit this by providing a specially crafted YAML document, leading to potential information disclosure. This issue is an incomplete fix...