Skip to main content

YAML::Syck CVE-2026-57077

| EUVDEUVD-2026-45056 HIGH
Out-of-bounds Read (CWE-125)
2026-07-16 CPANSec GHSA-5wqv-8x52-77q2
Buffer Overflow Information Disclosure Red Hat Suse Yaml Toddr
7.7
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.8 MEDIUM

Triggered by parsing an untrusted document (AV:L, PR:N, UI:N); a single-byte over-read gives limited disclosure (C:L) but a reliable crash (A:H), with no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 10:02 vuln.today
Analysis Generated
Jul 22, 2026 - 10:02 vuln.today
CVE Published
Jul 16, 2026 - 21:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 16, 2026 - 21:41 cve.org
HIGH 7.7

DescriptionCVE.org

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len.

In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.

Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

AnalysisAI

Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.

Technical ContextAI

YAML::Syck is a Perl XS binding around the C 'libsyck' YAML/JSON parser, which is vendored into the distribution. The root cause is CWE-125 (out-of-bounds read): during block-scalar lexing, the helper routines newline_len and is_newline dereference the lexer's scan pointer and, when detecting a Windows-style "\r\n" sequence, also the byte immediately after it. libsyck's lexer buffer is not guaranteed NUL-terminated and these helpers perform no end-of-buffer check, so at a document boundary the scan advances one byte past the allocated heap buffer. Because this is the same libsyck newline-scanning weakness family as CVE-2025-11683, the 1.47 release (commit 44c90a1) is a follow-up hardening; the same commit also addresses sibling libsyck defects (base64 signed-char table indexing in emitter.c, and anchor-node use-after-free handling via a new syck_retire_node/retired-table mechanism in handler.c), indicating a coordinated CPANSec memory-safety sweep rather than a single isolated bug.

RemediationAI

Vendor-released patch: upgrade to YAML::Syck 1.47 or later, which adds the missing bounds checks in the libsyck newline scan (fix commit https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch, release notes https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes). Because this is an incomplete-fix follow-up to CVE-2025-11683, do not assume an earlier patched build is sufficient - confirm the installed version is >= 1.47. If you cannot upgrade immediately, the effective compensating control is to avoid parsing untrusted YAML with this module: stop calling Load/LoadFile on attacker-controlled documents, or route untrusted parsing to an alternative parser (e.g., YAML::PP or YAML::XS) as a temporary measure, accepting the behavioral/compatibility differences between parsers; where feasible, validate or reject inputs containing block scalars at document boundaries, though this is brittle and not a reliable filter. Consult the oss-security advisory at https://seclists.org/oss-sec/2026/q3/161 for details.

More in Yaml

View all
CVE-2023-2251 HIGH POC
7.5 Apr 24

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
CVE-2022-28948 HIGH POC
7.5 May 19

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
CVE-2026-57075 CRITICAL
9.1 Jul 16

Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feed
CVE-2026-4177 CRITICAL
9.1 Mar 16

A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attack
CVE-2026-57076 HIGH
7.8 Jul 16

Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when i
CVE-2022-3064 HIGH
7.5 Dec 27

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
CVE-2026-5089 HIGH
7.3 May 12

Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-b
CVE-2026-13713 MEDIUM
6.2 Jul 16

YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name,

CVE-2012-1152 MEDIUM
5.0 Sep 09

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-57077 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy