EUVD-2026-45052
GHSA-p3p9-6pr6-mr9m
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Input-driven crash with no config prerequisite; network-received YAML routinely reaches Load() in practice, so AV:N overrides the library-baseline AV:L; impact is availability-only.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.
In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.
Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.
AnalysisAI
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.
Technical ContextAI
YAML::Syck is a Perl YAML processing module (CPE: cpe:2.3:a:toddr:yaml::syck:*:*:*:*:*:*:*:*) that bundles libsyck, a C implementation of the YAML 1.0 specification. The defect resides in handler.c within syck_hdlr_add_anchor() and syck_hdlr_remove_anchor(). When a YAML anchor name is redefined or removed during parse, both functions call syck_free_node() to release the evicted node. Because that node may still be live on the parser's internal value stack, syck_hdlr_add_node() reaches it again and frees the same 48-byte chunk a second time - a classic CWE-416 use-after-free that degenerates into a double-free on the default code path. On a standard glibc build the allocator detects the corruption and aborts the interpreter. The fix in version 1.47 introduces syck_retire_node(), which inserts evicted nodes into a new st_table *retired field on the SyckParser struct and defers their release to parser teardown, eliminating the window during which the stack still holds a reference to the freed node. The same commit also fixes a signed-char OOB indexing issue in the base64 decoder (emitter.c) and at least two additional anchor-related memory-safety defects (CVE-2026-57075, CVE-2026-57076, CVE-2026-57077).
RemediationAI
Upgrade YAML::Syck to version 1.47 or later, available on CPAN at https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes; this is the primary and recommended fix. The upstream patch is available at https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch for environments that build from source. If immediate upgrade is not feasible and the application processes untrusted YAML, consider switching the serialization stack to a pure-Perl YAML parser such as YAML::PP that does not share the libsyck C backend - note this may introduce API and compatibility differences that require application-level testing. Alternatively, implement an input-layer pre-filter that rejects YAML documents containing anchor redefinitions before they reach Load() or LoadFile(); this is complex to implement correctly at the application layer and should be treated as a temporary stopgap only. Do not expose Load() or LoadFile() to untrusted input without one of these mitigations in place.
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feed
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attack
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when i
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-b
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today