YAML::Syck CVE-2026-13713

Exploitation requires that the target process calls YAML::Syck's Load() or LoadFile() on attacker-controlled YAML input containing a redefined anchor name (e.g., any document where the same anchor label appears twice, such as '- &a' followed by '&a' within the same stream). No special YAML::Syck configuration flags, non-default settings, or specific Perl version are required - the crash is triggered on the default Load() code path with no module options. What limits exploitation: the impact is denial-of-service only (interpreter abort), with no evidence of code execution; and the attacker must be able to supply YAML content to a process using YAML::Syck, which depends on the consuming application's input handling. CVSS PR:N confirms no authentication is required at the library level, though the consuming application may enforce its own authentication layer. The CVSS AV:L assignment reflects the library-baseline interpretation; applications that accept YAML over a network effectively expose this as a remotely triggerable crash with no privileges required.

The NVD-assigned CVSS 3.1 score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a library-baseline local attack vector and availability-only impact. The AV:L assignment is the conservative per-specification interpretation for a parsing library that does not itself bind to a network socket; however, in the predominant real-world deployment pattern - Perl web applications and API services passing user-supplied YAML bodies to Load() - the effective attack vector is network-reachable with no authentication required, materially increasing practical risk above the 6.2 baseline. Attack complexity is genuinely low: no heap grooming, timing manipulation, or information leak is required; redefinition of any anchor name deterministically triggers the double-free. No EPSS data was provided in the source intelligence; no CISA KEV listing exists, so confirmed active exploitation is unconfirmed at time of analysis. POC trigger inputs (e.g., the 7-byte document redefining an anchor) are embedded in the project's public test suite and CI workflow, making reproduction trivial for any researcher. Impact is strictly denial-of-service - there is no evidence of code execution potential from this double-free path. The CVSS AV:L vs. real-world AV:N discrepancy is the key signal: security teams operating Perl web services should treat effective exploitability as higher than the published score implies.

An attacker submits a crafted YAML payload - as short as seven bytes, containing a document that redefines an anchor name - to a web application or API endpoint that parses the request body using YAML::Syck's Load() function. The Perl interpreter aborts due to the double-free detected by the allocator, crashing the worker process and producing a denial of service. Because the trigger is deterministic and requires no heap shaping, the attacker can repeat the request at will to sustain downtime; the trigger input is publicly available in the project's test suite (t/cve-2026-13713-anchor-node-uaf.t).