Heap use-after-free in YAML::Syck for Perl (CVE-2026-57076)

CVE-2026-57076 is a heap use-after-free vulnerability in YAML::Syck for Perl, located in the bundled libsyck library's syck_hdlr_add_anchor function. An anchor name is stored as both a node field and a key in the parser's anchors table; when the node is freed, the shared key is also freed, and a subsequent anchor redefinition causes st_strcmp to read freed heap memory. Any caller invoking Load or LoadFile on an untrusted YAML document that redefines an anchor is affected, as anchors require no special flags and are reachable on the default load path. Affected versions: - before 1.47 We recommend updating to: 1.47. CVSS 7.8 · our assessment: this_week Vendor advisory: https://seclists.org/oss-sec/2026/q3/160 Details: https://vuln.today/cve/CVE-2026-57076