Toddr
Monthly
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when it redefines a previously declared anchor. The bug lives in the bundled libsyck C code (syck_hdlr_add_anchor), where an anchor name string is shared between a node's node->anchor field and the parser's anchors-table key; freeing the node frees the shared key, and a subsequent anchor redefinition makes st_delete/st_strcmp compare against freed heap memory. Any Perl application that calls Load or LoadFile on untrusted YAML is affected on the default code path (anchors need no special flags). Reported by CPANSec and disclosed via oss-security; publicly documented proof-of-concept trigger inputs exist, but there is no CISA KEV listing and no evidence of active exploitation.
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attackers to potentially execute arbitrary code or cause denial of service without authentication. The vulnerability stems from multiple memory corruption issues including heap overflow when processing YAML class names exceeding 512 bytes, buffer overread in base64 decoding, and memory leaks. With a CVSS score of 9.1 and network-based attack vector requiring no user interaction, this presents a severe risk to applications parsing untrusted YAML input.
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when it redefines a previously declared anchor. The bug lives in the bundled libsyck C code (syck_hdlr_add_anchor), where an anchor name string is shared between a node's node->anchor field and the parser's anchors-table key; freeing the node frees the shared key, and a subsequent anchor redefinition makes st_delete/st_strcmp compare against freed heap memory. Any Perl application that calls Load or LoadFile on untrusted YAML is affected on the default code path (anchors need no special flags). Reported by CPANSec and disclosed via oss-security; publicly documented proof-of-concept trigger inputs exist, but there is no CISA KEV listing and no evidence of active exploitation.
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-bounds memory reads when parsing specially crafted base60 (sexagesimal) YAML values. The vulnerability affects both integer and floating-point base60 handlers in perl_syck.h, where processing leftmost colon-separated segments causes a pointer to decrement past allocated buffer boundaries. EPSS exploitation probability is minimal (0.01%, 3rd percentile) with no active exploitation or public weaponized exploit identified. Vendor-released patch available in version 1.38, confirmed by CPANSec and upstream commit.
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attackers to potentially execute arbitrary code or cause denial of service without authentication. The vulnerability stems from multiple memory corruption issues including heap overflow when processing YAML class names exceeding 512 bytes, buffer overread in base64 decoding, and memory leaks. With a CVSS score of 9.1 and network-based attack vector requiring no user interaction, this presents a severe risk to applications parsing untrusted YAML input.
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.