EUVD-2026-45055
GHSA-q6x2-vfpr-9j7p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Untrusted documents are attacker-controlled and commonly network-delivered (AV:N, PR:N, no auth); impact is a UAF read causing limited heap exposure and possible crash (C:L/A:L), not confirmed integrity loss (I:N); NVD's AV:L/PR:L and H/H/H appear overstated.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor.
In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.
Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.
AnalysisAI
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when it redefines a previously declared anchor. The bug lives in the bundled libsyck C code (syck_hdlr_add_anchor), where an anchor name string is shared between a node's node->anchor field and the parser's anchors-table key; freeing the node frees the shared key, and a subsequent anchor redefinition makes st_delete/st_strcmp compare against freed heap memory. Any Perl application that calls Load or LoadFile on untrusted YAML is affected on the default code path (anchors need no special flags). Reported by CPANSec and disclosed via oss-security; publicly documented proof-of-concept trigger inputs exist, but there is no CISA KEV listing and no evidence of active exploitation.
Technical ContextAI
YAML::Syck is a Perl XS binding around the legacy libsyck C YAML/JSON parser (CPE cpe:2.3:a:toddr:yaml::syck). YAML anchors (&name) and aliases (*name) are a standard serialization feature used to reference repeated nodes; the parser stores each anchor in an internal st_table (anchors) keyed by the anchor name. The root cause is CWE-416 (Use After Free): the anchor name is allocated once by syck_strndup and stored in two places with overlapping lifetimes - as node->anchor (freed with the node) and as the anchors-table key. When an anchor is redefined, the old node is freed, which frees the shared key string, but the stale key pointer remains in the table so the next st_delete key comparison (st_strcmp) dereferences freed memory. The upstream fix stops freeing evicted nodes inline (new syck_retire_node defers them to a p->retired table for teardown) and gives the anchors/bad_anchors tables their own syck_strndup-duplicated key strings so table keys no longer alias node-owned memory. The same commit also hardens two adjacent defects (signed-char base64 table indexing in syck_base64dec for CVE-2026-57075 and a newline over-read for CVE-2026-57077).
RemediationAI
Vendor-released patch: YAML::Syck 1.47 - upgrade to 1.47 or later from CPAN, which is the primary and complete fix (commit 44c90a109ec3215ee7ce747bd11209835e123d8b, https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch; changelog https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes). Rebuild or repackage any application that statically bundles libsyck so the fixed C code is actually shipped, not just the CPAN metadata. Where immediate upgrade is not possible, the actionable compensating control is to stop passing untrusted input to YAML::Syck::Load/LoadFile: route attacker-controlled documents through a memory-safe parser (YAML::PP is pure Perl) or validate/reject documents that redefine an anchor name before parsing - the trade-off is added latency and the loss of YAML::Syck's speed, and pre-parsing to detect duplicate anchors is itself non-trivial. If the module is only used for trusted internal data, restrict which code paths can reach it and ensure no network-facing endpoint feeds it user-supplied YAML. See the oss-security advisory (https://seclists.org/oss-sec/2026/q3/160) and VulDB entry (https://vuldb.com/vuln/379672) for disclosure detail.
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feed
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attack
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-b
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name,
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today