EUVD-2026-29543
GHSA-jcwf-qrr5-xwq3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
YAML::Syck versions before 1.38 for Perl has an out-of-bounds read.
The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:
while ( colon >= ptr && *colon != ':' ) { colon--; } if ( *colon == ':' ) *colon = '\0'; // colon may be ptr-1 here
When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.
AnalysisAI
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
Technical ContextAI
YAML::Syck is a Perl binding for the Syck YAML parser library, implementing YAML 1.0 serialization. The vulnerability resides in the base60 (sexagesimal) number parsing logic within perl_syck.h, which handles YAML timestamps and duration values in colon-separated format (e.g., hours:minutes:seconds). The flaw occurs in both int#base60 and float#base60 type handlers when processing the leftmost segment of a value without colons. The condition 'while (colon >= ptr && *colon != ':')' allows the colon pointer to decrement to ptr-1 when no colon is found, then unconditionally dereferences this out-of-bounds pointer with '*colon == ':''. This represents CWE-124 (Buffer Underrun/'Buffer Underflow'), a memory safety issue where reading before the allocated buffer can expose adjacent memory contents or cause crashes. The affected CPE (cpe:2.3:a:toddr:yaml::syck) confirms this impacts the TODDR-maintained CPAN distribution of YAML::Syck.
RemediationAI
Upgrade YAML::Syck to version 1.38 or later immediately for all Perl installations processing YAML from untrusted sources. The fix is available through standard CPAN distribution channels using 'cpan YAML::Syck' or 'cpanm YAML::Syck' for cpanminus users. The patch commit (https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch) changes the boundary check from 'colon >= ptr' to 'colon > ptr' preventing pointer underflow, and adds explicit handling for the no-colon case. For environments unable to upgrade immediately, implement input validation to reject or sanitize YAML containing base60/sexagesimal notation (colon-separated numeric values) before passing to YAML::Syck. Specifically, block or escape patterns matching timestamp/duration formats like '1:30:45' or simple ratios like '59:59'. Note this workaround breaks legitimate base60 value parsing and may cause application compatibility issues with YAML documents using YAML 1.0 timestamp types. Alternatively, migrate to YAML::XS or YAML::PP parsers which use different codebases unaffected by this specific flaw, though migration requires testing for behavioral differences in YAML parsing semantics. Monitor https://github.com/cpan-authors/YAML-Syck/pull/133 and http://www.openwall.com/lists/oss-security/2026/05/12/16 for additional vendor guidance.
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feed
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attack
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when i
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name,
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p
Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today